Netty HTTP/2 CVE-2026-47244

The primary fix is to upgrade io.netty:netty-codec-http2 to 4.1.135.Final (for 4.1.x users) or 4.2.15.Final (for 4.2.x users); both releases are confirmed by the Netty project at https://github.com/netty/netty/releases/tag/netty-4.1.135.Final and https://github.com/netty/netty/releases/tag/netty-4.2.15.Final respectively. As a compensating control for deployments that cannot immediately upgrade, application code should explicitly call initialSettings().maxConcurrentStreams(n) with a finite bound - the HTTP/2 specification and common practice suggest values in the range of 100 to 1000 depending on workload; this directly inserts SETTINGS_MAX_CONCURRENT_STREAMS into the server's SETTINGS frame and activates enforcement in DefaultHttp2Connection.DefaultEndpoint. Trade-off: setting this value too low may reject legitimate high-concurrency clients (e.g., browsers that pipeline aggressively), so the value should be tuned to observed peak legitimate traffic. A second-layer mitigation is to impose per-IP or per-connection stream-rate limits at a reverse proxy or load balancer (e.g., nginx http2_max_concurrent_streams, HAProxy h2-max-concurrent-streams), which limits amplification without modifying the Netty application itself. See the full advisory at https://github.com/netty/netty/security/advisories/GHSA-5x3r-wrvg-rp6q for vendor guidance.