)]}'
{
  "commit": "e1f2dbd873bf1dc5d26218276a40c055ab49c4f4",
  "tree": "6c8ecec96786d30fad253c9fcf53d35b8805b2f8",
  "parents": [
    "ee8232feb42e64bff79eb9be1ff107da7c10d9e7"
  ],
  "author": {
    "name": "Kannan J",
    "email": "kannanjgithub@google.com",
    "time": "Wed Jul 29 11:29:45 2026 +0000"
  },
  "committer": {
    "name": "GitHub",
    "email": "noreply@github.com",
    "time": "Wed Jul 29 16:59:45 2026 +0530"
  },
  "message": "netty: Fix client-initiated stream limit bypass in NettyServerHandler (v1.83.x backport) (#12942)\n\nBackport of #12933 to v1.83.x.\n---\nConfigure connection.remote().maxActiveStreams(maxStreams) directly upon\n`DefaultHttp2Connection` initialization.\nBecause `NettyServerHandler` instantiates `DefaultHttp2Connection`\ndirectly rather than using Netty\u0027s\n`AbstractHttp2ConnectionHandlerBuilder`, it missed Netty\u0027s built-in\nCVE-2026-47244 patch. This left a pre-handshake window where the\nserver\u0027s local connection allowed up to Integer.MAX_VALUE active\nclient-initiated streams until a SETTINGS_ACK was received. Enforcing\nthe limit proactively at startup closes this vulnerability window and\nprevents client-initiated stream floods / resource exhaustion.\n\nFixes #12930",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "79715ca29960989ae17e9945d18eb9a85c1336a7",
      "old_mode": 33188,
      "old_path": "netty/src/main/java/io/grpc/netty/NettyServerHandler.java",
      "new_id": "58166f50f7e28d4ef4a76fe1c619764d79f556f7",
      "new_mode": 33188,
      "new_path": "netty/src/main/java/io/grpc/netty/NettyServerHandler.java"
    },
    {
      "type": "modify",
      "old_id": "1c8d2b5479d3c689a6e751cc1ede1701b3ca76da",
      "old_mode": 33188,
      "old_path": "netty/src/test/java/io/grpc/netty/NettyServerHandlerTest.java",
      "new_id": "84a1a48b37fb19c2f87c1f04c9826fc3ba06b1b7",
      "new_mode": 33188,
      "new_path": "netty/src/test/java/io/grpc/netty/NettyServerHandlerTest.java"
    }
  ]
}