#20376
89%
master: 89%

Ran 29 Jul 2026 11:43AM UTC

Jobs 1

Files 653

Run time 1min

Badge

Embed ▾

Committed 29 Jul 2026 11:30AM UTC coverage: 88.844% (+0.007%) from 88.837%

Build # #20376

Build Type

push

github

Committed by

web-flow

Commit Message

netty: Fix client-initiated stream limit bypass in NettyServerHandler (v1.82.x backport) (#12941)

Backport of #12933 to v1.82.x.
---
Configure connection.remote().maxActiveStreams(maxStreams) directly upon
`DefaultHttp2Connection` initialization.
Because `NettyServerHandler` instantiates `DefaultHttp2Connection`
directly rather than using Netty's
`AbstractHttp2ConnectionHandlerBuilder`, it missed Netty's built-in
CVE-2026-47244 patch. This left a pre-handshake window where the
server's local connection allowed up to Integer.MAX_VALUE active
client-initiated streams until a SETTINGS_ACK was received. Enforcing
the limit proactively at startup closes this vulnerability window and
prevents client-initiated stream floods / resource exhaustion.

Fixes #12930

Coverage Stats

36292 of 40849 relevant lines covered (88.84%)

0.89 hits per line

Coverage Regressions

Lines	Coverage	∆	File
26	91.23	0.02%	../netty/src/main/java/io/grpc/netty/NettyServerHandler.java
3	95.07	-0.44%	../core/src/main/java/io/grpc/internal/RetriableStream.java
1	93.21	-0.14%	../okhttp/src/main/java/io/grpc/okhttp/OkHttpClientTransport.java

Jobs

ID	Job ID	Ran	Files	Coverage
1	#20376.1	29 Jul 2026 11:43AM UTC	653	88.84

grpc / grpc-java / #20376
89%
master: 89%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build #20376

grpc / grpc-java / #20376 89% master: 89%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build #20376

grpc / grpc-java / #20376
89%
master: 89%

README BADGES
x