CVE-2026-100658 Details

A denial-of-service vulnerability has been identified in Netty's WebSocketServerExtensionHandler, part of the netty-codec-http component. This issue arises from an unbounded per-connection queue that can be exploited by a remote, unauthenticated peer. The vulnerability is present in Netty versions 4.1.88.Final through 4.1.137.Final and 4.2.0.Final through 4.2.17.Final. The problem occurs because the handler adds an entry to its validExtensions queue for every inbound HttpRequest, but only removes an entry when the application sends an HttpResponse. This lack of a size limit allows the queue to grow indefinitely. An attacker can use HTTP/1.1 pipelining to send requests more quickly than responses are generated, including regular non-upgrade HTTP requests to any path. As a result, the queue expands without restriction until the Java Virtual Machine (JVM) runs out of heap memory, leading to an OutOfMemoryError. Servers that enable WebSocket compression with the permessage-deflate extension are particularly vulnerable, as the issue can be exploited on the plain HTTP port before any WebSocket upgrade or application-level authentication takes place.

Users can upgrade to Netty versions 4.1.138.Final or 4.2.18.Final, where this vulnerability has been fixed.