Netty before 4.1.138.Final Denial of Service via WebSocketServerExtensionHandler
Netty (io.netty:netty-codec-http) contains an unbounded per-connection queue in WebSocketServerExtensionHandler. The handler offers an entry to its per-channel validExtensions queue for every inbound HttpRequest, but polls an entry only when the application writes an HttpResponse, and the queue size is never bounded. A remote, unauthenticated peer can use HTTP/1.1 pipelining to send requests faster than the application produces responses — including plain non-upgrade HTTP requests to any path — causing the queue to grow without limit until the JVM exhausts heap memory and terminates with OutOfMemoryError. Because the affected handler is the base class of WebSocketServerCompressionHandler, any server that enables permessage-deflate is exposed on its plain HTTP port before any WebSocket upgrade completes and before any application-level authentication. Affected versions are 4.1.88.Final through 4.1.137.Final and 4.2.0.Final through 4.2.17.Final; the issue is fixed in 4.1.138.Final and 4.2.18.Final.
CVE-2026-100658
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:CVE-2026-100658
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"repo": "https://github.com/netty/netty",
"type": "GIT",
"events": [
{
"introduced": "828ea7ceeb72a9e0c943df8b5fe634ce1bd9537f"
},
{
"fixed": "26e68a2c3935e459b374891c87760f6d6c5e2550"
},
{
"introduced": "09e64d259c99be8b5b2a471a78f11e65eb82598a"
},
{
"fixed": "2521f494432e27415a567d3a81a9eb907abf20b3"
}
],
"database_specific": {
"source": "AFFECTED_FIELD",
"extracted_events": [
{
"introduced": "4.1.88.Final"
},
{
"fixed": "4.1.138.Final"
},
{
"introduced": "4.2.0.Final"
},
{
"fixed": "4.2.18.Final"
}
]
}
}
],
"versions": [
"netty-clang-bin",
"netty-4.1.137.Final",
"netty-4.2.17.Final",
"netty-4.1.136.Final",
"netty-4.2.16.Final",
"netty-4.1.135.Final",
"netty-4.2.15.Final",
"netty-4.1.134.Final",
"netty-4.2.14.Final",
"netty-4.1.133.Final",
"netty-4.2.13.Final",
"netty-4.2.12.Final",
"netty-4.1.132.Final",
"netty-4.2.11.Final",
"netty-4.1.131.Final",
"netty-4.2.10.Final",
"netty-4.2.9.Final",
"netty-4.1.130.Final",
"netty-4.2.8.Final",
"netty-4.1.129.Final",
"netty-4.1.128.Final",
"netty-4.2.7.Final",
"netty-4.2.6.Final",
"netty-4.1.127.Final",
"netty-4.2.5.Final",
"netty-4.1.126.Final",
"netty-4.1.125.Final",
"netty-4.2.4.Final",
"netty-4.1.124.Final",
"netty-4.1.123.Final",
"netty-4.2.3.Final",
"netty-4.2.2.Final",
"netty-4.1.122.Final",
"netty-4.2.1.Final",
"netty-4.1.121.Final",
"netty-4.1.120.Final",
"netty-4.2.0.Final",
"netty-4.1.119.Final",
"netty-4.1.118.Final",
"netty-4.1.117.Final",
"netty-4.1.116.Final",
"netty-4.1.115.Final",
"netty-4.1.114.Final",
"netty-4.1.113.Final",
"netty-4.1.112.Final",
"netty-4.1.111.Final",
"netty-4.1.110.Final",
"netty-4.1.109.Final",
"netty-4.1.108.Final",
"netty-4.1.107.Final",
"netty-4.1.106.Final",
"netty-4.1.105.Final",
"netty-4.1.104.Final",
"netty-4.1.103.Final",
"netty-4.1.102.Final",
"netty-4.1.101.Final",
"netty-4.1.100.Final",
"netty-4.1.99.Final",
"netty-4.1.98.Final",
"netty-4.1.97.Final",
"netty-4.1.96.Final",
"netty-4.1.95.Final",
"netty-4.1.94.Final",
"netty-4.1.93.Final",
"netty-4.1.92.Final",
"netty-4.1.91.Final",
"netty-4.1.90.Final",
"netty-4.1.89.Final",
"netty-4.1.88.Final"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100658.json"
}
}
]- Related CVEs
- CVE-2026-100658
Source reference:
/id
Publisher severity
No explicit severity was provided.
- Event
- #23959 · Revision 1
- Added to Heist Feed
- Publisher date