CVE-2026-100658

io.netty/netty-codec-http: Netty: Denial of Service via unbounded queue in WebSocketServerExtensionHandler

View on CVE.org

Published Sep 26, 2026 CVSS 3.1 · 5.3 Medium EPSS n/a KEV · Not listed

Description

This CVE ID has been rejected as a duplicate.

Affected Products

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://github.com/netty/netty/security/advisories/GHSA-2g37-3h88-55hc
https://nvd.nist.gov/vuln/detail/CVE-2026-100658
https://www.cve.org/CVERecord?id=CVE-2026-100658
https://www.vulncheck.com/advisories/netty-before-4.1.138-final-denial-of-service-via-websocketserverextensionhandler

History

Sep 30, 2026 12:15 AM Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title		io.netty/netty-codec-http: Netty: Denial of Service via unbounded queue in WebSocketServerExtensionHandler
Weaknesses		CWE-770
References		https://github.com/netty/netty/security/advisories/GHSA-2g37-3h88-55hc https://nvd.nist.gov/vuln/detail/CVE-2026-100658 https://www.cve.org/CVERecord?id=CVE-2026-100658 https://www.vulncheck.com/advisories/netty-before-4.1.138-final-denial-of-service-via-websocketserverextensionhandler
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}` threat_severity `Moderate`

Sep 28, 2026 10:30 PM Weaknesses updated. References updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-770
References	https://github.com/netty/netty/security/advisories/GHSA-2g37-3h88-55hc https://www.vulncheck.com/advisories/netty-before-4.1.138-final-denial-of-service-via-websocketserverextensionhandler
Metrics	cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X'}`

Sep 28, 2026 9:30 PM Description updated. Title updated. Affected versions updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description	Netty (io.netty:netty-codec-http) contains an unbounded per-connection queue in WebSocketServerExtensionHandler. The handler offers an entry to its per-channel validExtensions queue for every inbound HttpRequest, but polls an entry only when the application writes an HttpResponse, and the queue size is never bounded. A remote, unauthenticated peer can use HTTP/1.1 pipelining to send requests faster than the application produces responses — including plain non-upgrade HTTP requests to any path — causing the queue to grow without limit until the JVM exhausts heap memory and terminates with OutOfMemoryError. Because the affected handler is the base class of WebSocketServerCompressionHandler, any server that enables permessage-deflate is exposed on its plain HTTP port before any WebSocket upgrade completes and before any application-level authentication. Affected versions are 4.1.88.Final through 4.1.137.Final and 4.2.0.Final through 4.2.17.Final; the issue is fixed in 4.1.138.Final and 4.2.18.Final.	This CVE ID has been rejected as a duplicate.
Title	Netty before 4.1.138.Final Denial of Service via WebSocketServerExtensionHandler
CPEs	cpe:2.3:a:netty:netty::::::::
Metrics	cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}`	cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X'}`

Sep 26, 2026 1:30 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Netty (io.netty:netty-codec-http) contains an unbounded per-connection queue in WebSocketServerExtensionHandler. The handler offers an entry to its per-channel validExtensions queue for every inbound HttpRequest, but polls an entry only when the application writes an HttpResponse, and the queue size is never bounded. A remote, unauthenticated peer can use HTTP/1.1 pipelining to send requests faster than the application produces responses — including plain non-upgrade HTTP requests to any path — causing the queue to grow without limit until the JVM exhausts heap memory and terminates with OutOfMemoryError. Because the affected handler is the base class of WebSocketServerCompressionHandler, any server that enables permessage-deflate is exposed on its plain HTTP port before any WebSocket upgrade completes and before any application-level authentication. Affected versions are 4.1.88.Final through 4.1.137.Final and 4.2.0.Final through 4.2.17.Final; the issue is fixed in 4.1.138.Final and 4.2.18.Final.
Title		Netty before 4.1.138.Final Denial of Service via WebSocketServerExtensionHandler
First Time appeared		Netty Netty netty
Weaknesses		CWE-770
CPEs		cpe:2.3:a:netty:netty::::::::
Vendors & Products		Netty Netty netty
References		https://github.com/netty/netty/security/advisories/GHSA-2g37-3h88-55hc https://www.vulncheck.com/advisories/netty-before-4.1.138-final-denial-of-service-via-websocketserverextensionhandler
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}`