#20375
89%
master: 89%

Ran 29 Jul 2026 11:41AM UTC

Jobs 1

Files 685

Run time 2min

Badge

Embed ▾

Committed 29 Jul 2026 11:29AM UTC coverage: 89.12% (+0.007%) from 89.113%

Build # #20375

Build Type

push

github

Committed by

web-flow

Commit Message

netty: Fix client-initiated stream limit bypass in NettyServerHandler (v1.83.x backport) (#12942)

Backport of #12933 to v1.83.x.
---
Configure connection.remote().maxActiveStreams(maxStreams) directly upon
`DefaultHttp2Connection` initialization.
Because `NettyServerHandler` instantiates `DefaultHttp2Connection`
directly rather than using Netty's
`AbstractHttp2ConnectionHandlerBuilder`, it missed Netty's built-in
CVE-2026-47244 patch. This left a pre-handshake window where the
server's local connection allowed up to Integer.MAX_VALUE active
client-initiated streams until a SETTINGS_ACK was received. Enforcing
the limit proactively at startup closes this vulnerability window and
prevents client-initiated stream floods / resource exhaustion.

Fixes #12930

Coverage Stats

38024 of 42666 relevant lines covered (89.12%)

0.89 hits per line

Coverage Regressions

Lines	Coverage	∆	File
26	91.23	0.02%	../netty/src/main/java/io/grpc/netty/NettyServerHandler.java
3	74.14	-2.59%	../servlet/src/main/java/io/grpc/servlet/ServletServerStream.java
1	87.6	-0.83%	../rls/src/main/java/io/grpc/rls/LinkedHashLruCache.java
1	92.99	0.93%	../xds/src/main/java/io/grpc/xds/client/ControlPlaneClient.java
1	96.55	-0.57%	../xds/src/main/java/io/grpc/xds/client/LoadReportClient.java

Jobs

ID	Job ID	Ran	Files	Coverage
1	#20375.1	29 Jul 2026 11:41AM UTC	685	89.12

grpc / grpc-java / #20375
89%
master: 89%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build #20375

grpc / grpc-java / #20375 89% master: 89%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build #20375

grpc / grpc-java / #20375
89%
master: 89%

README BADGES
x