Resource exhaustion via unbounded SPDY SETTINGS map in Netty (CVE-2026-55831)

Netty's SPDY SETTINGS decoder accepts a peer-declared entry count up to the 24-bit frame-length limit and materializes every unique setting ID into a TreeMap-backed DefaultSpdySettingsFrame without an implementation-level count cap. A remote unauthenticated SPDY/3.1 peer can send a single syntactically valid ~2 MiB SETTINGS frame that creates 262,144 map entries, amplifying network input into heap growth and ordered-map insertion CPU work, resulting in a denial-of-service condition. Affected versions: - >= 4.2.0.Final, <= 4.2.15.Final - >= 4.1.0.Final, <= 4.1.135.Final We recommend updating to: 4.2.16.Final, 4.1.136.Final. CVSS 7.5 · our assessment: this_week Reference: https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w Details: https://vuln.today/cve/CVE-2026-55831