[Master] Enforce HTTP/2 maxConcurrentStreams limit on server#2637

Open

daneshk wants to merge 14 commits into

fix/http2-max-concurrent-streams

Commits on Jun 30, 2026

Fix CVE-2026-47244: enforce HTTP/2 maxConcurrentStreams limit on server
daneshk
committed
Document HTTP/2 maxConcurrentStreams limit and system property override
daneshk
committed
Fix test to use ListenerConfiguration instead of system property for master branch
daneshk
committed

Commits on Jul 1, 2026

Rework CVE-2026-47244 fix to derive maxActiveStreams from global pool config
daneshk
committed
Add optional http2MaxActiveStreams field to ListenerConfiguration
daneshk
committed
Fix Http2Settings API call: maxConcurrentStreams is the Netty method name
daneshk
committed
Remove unused globalHttp2MaxActiveStreams field and client pool coupling

daneshk
and
claude
committed
Fix README: server stream limit defaults to 100, tunable via http2MaxActiveStreams
daneshk
committed
Fix ballerina/README.md: server stream limit tunable via http2MaxActiveStreams
daneshk
committed
Fix method name mismatch: use setHttp2MaxConcurrentStreams in HttpUtil and test
daneshk
committed
Remove -1 unlimited sentinel from http2MaxActiveStreams listener config
daneshk
committed
Change http2MaxActiveStreams to int with default 100 in Ballerina, remove Java defaults
daneshk
committed
Fix Long to int cast and restore 100 default in Java fallback fields
daneshk
committed

Commits on Jul 6, 2026

Move HTTP/2 stream concurrency docs from README to spec

daneshk
and
claude
committed