)]}'
{
  "commit": "731eaf9efa5accfb8ac9e96d9f9c743a716db444",
  "tree": "1a0dd50d0078df4afd25f8db87c97572b6c1581f",
  "parents": [
    "dd9f8eb7eb193c2535defc9213ffe980f0f29148"
  ],
  "author": {
    "name": "Kannan J",
    "email": "kannanjgithub@google.com",
    "time": "Wed Jul 29 11:30:19 2026 +0000"
  },
  "committer": {
    "name": "GitHub",
    "email": "noreply@github.com",
    "time": "Wed Jul 29 17:00:19 2026 +0530"
  },
  "message": "netty: Fix client-initiated stream limit bypass in NettyServerHandler (v1.82.x backport) (#12941)\n\nBackport of #12933 to v1.82.x.\n---\nConfigure connection.remote().maxActiveStreams(maxStreams) directly upon\n`DefaultHttp2Connection` initialization.\nBecause `NettyServerHandler` instantiates `DefaultHttp2Connection`\ndirectly rather than using Netty\u0027s\n`AbstractHttp2ConnectionHandlerBuilder`, it missed Netty\u0027s built-in\nCVE-2026-47244 patch. This left a pre-handshake window where the\nserver\u0027s local connection allowed up to Integer.MAX_VALUE active\nclient-initiated streams until a SETTINGS_ACK was received. Enforcing\nthe limit proactively at startup closes this vulnerability window and\nprevents client-initiated stream floods / resource exhaustion.\n\nFixes #12930",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "79715ca29960989ae17e9945d18eb9a85c1336a7",
      "old_mode": 33188,
      "old_path": "netty/src/main/java/io/grpc/netty/NettyServerHandler.java",
      "new_id": "58166f50f7e28d4ef4a76fe1c619764d79f556f7",
      "new_mode": 33188,
      "new_path": "netty/src/main/java/io/grpc/netty/NettyServerHandler.java"
    },
    {
      "type": "modify",
      "old_id": "1c8d2b5479d3c689a6e751cc1ede1701b3ca76da",
      "old_mode": 33188,
      "old_path": "netty/src/test/java/io/grpc/netty/NettyServerHandlerTest.java",
      "new_id": "84a1a48b37fb19c2f87c1f04c9826fc3ba06b1b7",
      "new_mode": 33188,
      "new_path": "netty/src/test/java/io/grpc/netty/NettyServerHandlerTest.java"
    }
  ]
}