[Security][grpc-java] CVE-2026-47244 may remain unenforced in NettyServerHandler

[lxcmyf]

Hello gRPC Security Team,

I am contacting you regarding the publicly disclosed Netty vulnerability
CVE-2026-47244 (GHSA-5x3r-wrvg-rp6q).

Netty addressed the issue by configuring:

connection.remote().maxActiveStreams(maxConcurrentStreams)

inside AbstractHttp2ConnectionHandlerBuilder.

However, grpc-java's NettyServerHandler creates DefaultHttp2Connection,
DefaultHttp2ConnectionEncoder, and DefaultHttp2ConnectionDecoder directly,
without using that builder.

As of grpc-java 1.83.0 and the current master branch, NettyServerHandler sets:

settings.maxConcurrentStreams(maxStreams);

but does not appear to set:

connection.remote().maxActiveStreams(maxStreams);

This seems to mean the server advertises SETTINGS_MAX_CONCURRENT_STREAMS
without enforcing the same limit locally for client-initiated streams.

Could you please confirm:

1. Whether the grpc-java team is aware of this interaction with
   CVE-2026-47244.
2. Whether grpc-netty and grpc-netty-shaded are considered affected.
3. Whether a fix is currently planned.
4. Which grpc-java release is expected to contain the fix and whether an
   estimated release timeline is available.
5. Whether there is a recommended mitigation for existing grpc-java users.

References:

• Netty advisory:
  GHSA-5x3r-wrvg-rp6q
• Netty fix:
  HTTP/2: Enforce max concurrent streams for misbehaving clients netty/netty#16876
• grpc-java 1.83.0 NettyServerHandler:
  https://github.com/grpc/grpc-java/blob/v1.83.0/netty/src/main/java/io/grpc/netty/NettyServerHandler.java

Thank you.

[kannanjgithub]

Yes, the vulnerability exists in grpc-netty and grpc-netty-shaded. We will make the fix to enforce the stream limit in 1.84 and also make a patch release 1.83.1 with it.