CVE-2026-100658
Received Received - Intake

Memory Exhaustion in Netty WebSocketServerExtensionHandler

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Netty (io.netty:netty-codec-http) contains an unbounded per-connection queue in WebSocketServerExtensionHandler. The handler offers an entry to its per-channel validExtensions queue for every inbound HttpRequest, but polls an entry only when the application writes an HttpResponse, and the queue size is never bounded. A remote, unauthenticated peer can use HTTP/1.1 pipelining to send requests faster than the application produces responses — including plain non-upgrade HTTP requests to any path — causing the queue to grow without limit until the JVM exhausts heap memory and terminates with OutOfMemoryError. Because the affected handler is the base class of WebSocketServerCompressionHandler, any server that enables permessage-deflate is exposed on its plain HTTP port before any WebSocket upgrade completes and before any application-level authentication. Affected versions are 4.1.88.Final through 4.1.137.Final and 4.2.0.Final through 4.2.17.Final; the issue is fixed in 4.1.138.Final and 4.2.18.Final.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100658
EUVD
EUVD-2026-87752

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
netty netty_codec_http From 4.1.88.Final (inc) to 4.1.137.Final (inc)
netty netty_codec_http From 4.2.0.Final (inc) to 4.2.17.Final (inc)
netty netty From 4.1.88_final (inc) to 4.1.137_final (inc)
netty netty From 4.2.0_final (inc) to 4.2.17_final (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Netty's WebSocketServerExtensionHandler involves an unbounded queue that grows with every inbound HTTP request. The handler adds entries to a queue for each request but only removes them when responses are sent. Attackers can exploit HTTP/1.1 pipelining to send requests faster than responses are generated, causing the queue to fill up until the server runs out of memory and crashes.

Detection Guidance

Monitor for OutOfMemoryError exceptions in JVM logs, especially after HTTP/1.1 pipelining requests. Check for unbounded growth in WebSocketServerExtensionHandler's validExtensions queue size. Use tools like jstack to analyze thread dumps for memory issues.

Impact Analysis

This vulnerability can cause denial-of-service by crashing your application due to memory exhaustion. If you use WebSocket compression, unauthenticated attackers can target your plain HTTP port before any WebSocket upgrade or authentication, leading to service disruption.

Mitigation Strategies

Upgrade Netty to version 4.1.138.Final or later for 4.1.x, or 4.2.18.Final or later for 4.2.x. Disable permessage-deflate in WebSocketServerCompressionHandler if not required. Implement rate limiting on HTTP/1.1 pipelining requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100658. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart