CVE-2026-100658: Netty before 4.1.138.Final Denial of Service via WebSocketServerExtensionHandler
Rejected reason: This CVE ID has been rejected as a duplicate.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
io.netty:netty-codec-httpto a version that resolves this vulnerability.Fixed in 4.1.138.Final - Upgrade
Upgrade
io.netty:netty-codec-httpto a version that resolves this vulnerability.Fixed in 4.2.18.Final
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service condition?
Servers using netty-codec-http versions 4.1.88.Final through 4.1.137.Final or 4.2.0.Final through 4.2.17.Final are affected when they enable permessage-deflate through WebSocketServerCompressionHandler. Exposure exists on the plain HTTP port, including before a WebSocket upgrade or application authentication.
What does an attacker need to do to trigger the issue?
A remote unauthenticated peer can send HTTP/1.1 pipelined requests faster than the application returns responses. The requests can be ordinary non-upgrade HTTP requests to any path; a completed WebSocket upgrade is not required.
What is the operational impact of a successful attack?
The per-connection validExtensions queue can grow without limit, consuming JVM heap memory. This can end in an OutOfMemoryError and terminate the JVM.
What versions resolve the issue?
The issue is fixed in Netty 4.1.138.Final and 4.2.18.Final.