CVE-2026-100658

Name of the Vulnerable Software and Affected Versions Netty (io.netty:netty-codec-http) versions 4.1.88.Final through 4.1.137.Final Netty (io.netty:netty-codec-http) versions 4.2.0.Final through 4.2.17.Final

Description An unbounded per-connection queue exists in the WebSocketServerExtensionHandler. The handler adds an entry to its validExtensions queue for every inbound HttpRequest but only removes an entry when the application writes an HttpResponse. A remote, unauthenticated attacker can utilize HTTP/1.1 pipelining—a technique where multiple requests are sent over a single TCP connection without waiting for the corresponding responses—to send requests faster than the application can respond. This causes the queue to grow indefinitely, leading to JVM heap memory exhaustion and an OutOfMemoryError. Since this handler is the base class for WebSocketServerCompressionHandler, servers enabling permessage-deflate are exposed on their plain HTTP port before WebSocket upgrades or application-level authentication occur.

Recommendations Update to version 4.1.138.Final or later. Update to version 4.2.18.Final or later.