CVE-2026-100658 PUBLISHED

Netty before 4.1.138.Final Denial of Service via WebSocketServerExtensionHandler

Assigner: VulnCheck
Reserved: 26.09.2026 Published: 26.09.2026 Updated: 26.09.2026

Netty (io.netty:netty-codec-http) contains an unbounded per-connection queue in WebSocketServerExtensionHandler. The handler offers an entry to its per-channel validExtensions queue for every inbound HttpRequest, but polls an entry only when the application writes an HttpResponse, and the queue size is never bounded. A remote, unauthenticated peer can use HTTP/1.1 pipelining to send requests faster than the application produces responses — including plain non-upgrade HTTP requests to any path — causing the queue to grow without limit until the JVM exhausts heap memory and terminates with OutOfMemoryError. Because the affected handler is the base class of WebSocketServerCompressionHandler, any server that enables permessage-deflate is exposed on its plain HTTP port before any WebSocket upgrade completes and before any application-level authentication. Affected versions are 4.1.88.Final through 4.1.137.Final and 4.2.0.Final through 4.2.17.Final; the issue is fixed in 4.1.138.Final and 4.2.18.Final.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS Score: 6.9

Product Status

Vendor netty
Product netty
Versions Default: unaffected
  • affected from 4.1.88.Final to 4.1.138.Final (excl.)
  • Version 4.1.138.Final is unaffected
Vendor netty
Product netty
Versions Default: unaffected
  • affected from 4.2.0.Final to 4.2.18.Final (excl.)
  • Version 4.2.18.Final is unaffected

Credits

  • rajivraj reporter

References

Problem Types

  • Allocation of Resources Without Limits or Throttling CWE