Is CVE-2026-47244 actively exploited?

No active exploitation of CVE-2026-47244 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-47244 be exploited remotely?

Yes. CVE-2026-47244 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-47244?

CVE-2026-47244 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-47244

MEDIUM

CVE-2026-47244

CWE-400Published: June 12, 2026· Updated: Jun 17, 2026

5.3

CVSS v3.1

EPSS:0.51%probability of exploitation in 30 daysPercentile:39.0th

Official Description

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, DefaultHttp2Connection.DefaultEndpoint initialises maxActiveStreams/maxStreams to Integer.MAX_VALUE, and Http2Settings never inserts SETTINGS_MAX_CONCURRENT_STREAMS by default (Http2Settings.java:305-307 only clamps a user-supplied value). Unless the application explicitly calls initialSettings().maxConcurrentStreams(n), a Netty HTTP/2 server advertises no limit and enforces none locally. Each open stream allocates a DefaultStream object, PropertyMap slots, flow-controller state and IntObjectHashMap entry; with ~2^30 permissible odd stream IDs a single TCP connection can create hundreds of thousands of long-lived stream objects. This is also the precondition for CVE-2023-44487-style Rapid-Reset amplification, where the absence of a low concurrent cap multiplies backend work. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

NVD Source

Technical Analysis

CVE-2026-47244 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.