CVE-2026-100658: Netty before 4.1.138.Final Denial of Service via WebSocketServerExtensionHandler
Netty (io.netty:netty-codec-http) contains an unbounded per-connection queue in WebSocketServerExtensionHandler. The handler offers an entry to its per-channel validExtensions queue for every inbound HttpRequest, but polls an entry only when the application writes an HttpResponse, and the queue size is never bounded. A remote, unauthenticated peer can use HTTP/1.1 pipelining to send requests faster than the application produces responses — including plain non-upgrade HTTP requests to any path — causing the queue to grow without limit until the JVM exhausts heap memory and terminates with OutOfMemoryError. Because the affected handler is the base class of WebSocketServerCompressionHandler, any server that enables permessage-deflate is exposed on its plain HTTP port before any WebSocket upgrade completes and before any application-level authentication. Affected versions are 4.1.88.Final through 4.1.137.Final and 4.2.0.Final through 4.2.17.Final; the issue is fixed in 4.1.138.Final and 4.2.18.Final.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
io.netty:netty-codec-httpto a version that resolves this vulnerability.Fixed in 4.1.138.Final
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service condition?
Servers using netty-codec-http versions 4.1.88.Final through 4.1.137.Final or 4.2.0.Final through 4.2.17.Final are affected when they enable permessage-deflate through WebSocketServerCompressionHandler. Exposure exists on the plain HTTP port, including before a WebSocket upgrade or application authentication.
What does an attacker need to do to trigger the issue?
A remote unauthenticated peer can send HTTP/1.1 pipelined requests faster than the application returns responses. The requests can be ordinary non-upgrade HTTP requests to any path; a completed WebSocket upgrade is not required.
What is the operational impact of a successful attack?
The per-connection validExtensions queue can grow without limit, consuming JVM heap memory. This can end in an OutOfMemoryError and terminate the JVM.
What versions resolve the issue?
The issue is fixed in Netty 4.1.138.Final and 4.2.18.Final.