A flaw was discovered in the Netty library where the SpdySessionHandler accepts an unlimited number of remote‑initiated SPDY streams because its localConcurrentStreams parameter defaults to Integer.MAX_VALUE and cannot be altered by an API. A malicious peer can therefore open a SPDY connection and flood the server with many SYN_STREAM frames holding the FIN flag cleared, which forces the JVM to allocate heap and direct memory in an unbounded manner. When a memory allocation fails, the JVM throws an OutOfMemoryError, abruptly terminating the connection and potentially causing a service outage. This vulnerability thus provides a vector for a determinable denial of service through uncontrolled resource consumption, as catalogued by CWE‑770.

The affected products are all Red Hat offerings that embed Netty without a recent update, including Red Hat AMQ Broker 7, Red Hat AMQ Clients, Red Hat Build of Keycloak, Red Hat Data Grid 8, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 7 and 8, Red Hat Build of Apache Camel 4 for Quarkus 3, Red Hat Build of Apache Camel for Spring Boot 4, Red Hat Build of Apicurio Registry 3, Red Hat Build of Debezium 3, and Red Hat Build of Quarkus. No specific version ranges are provided; any deployment using a Netty version older than 4.1.138.Final or 4.2.18.Final remains vulnerable.

The CVSS score for this issue is 7.5, indicating a high severity denial of service. The EPSS score is 0.461% (approximately <1%), indicating a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no known wide‑scale active exploits at the time of reporting. Exploitation requires a remote peer to open a SPDY session, a capability commonly available to clients of any Internet‑exposed application using Netty. If triggered, an attacker could induce a JVM OutOfMemoryError, causing the service to crash or become unresponsive until the JVM recovers, leading to downtime and potential financial loss.