CVE-2026-93558: Io.netty/netty-codec-http: netty: unbounded per-connection queue growth in websocketserverextensionhandler leads to denial of service
Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven:io.netty:netty-codec-httpto a version that resolves this vulnerability.Patch GHSA-2g37-3h88-55hc
Event History
Frequently Asked Questions
Which deployments are exposed?
Servers that support WebSocket compression are exposed through their plain HTTP port. The affected handler is the base class of WebSocketServerCompressionHandler, which applications add to enable permessage-deflate.
What must an attacker do to trigger the condition?
A remote unauthenticated peer can use HTTP/1.1 pipelining to send requests faster than the application produces responses. No WebSocket upgrade needs to complete, and authentication performed after the HTTP endpoint is reached does not prevent the attack.
How can an operator recognize that a server is affected or under attack?
The handler maintains a per-connection validExtensions queue with an entry for each inbound HttpRequest, removing entries only when the application writes HttpResponse messages. Sustained request pipelining without matching response throughput can grow this queue until the JVM exhausts heap and terminates with OutOfMemoryError.