CVE-2026-100658
Description
A flaw was found in Netty. An unbounded memory queue in the WebSocket server extension handler allows an unauthenticated remote attacker to cause a Denial of Service (DoS). By sending pipelined HTTP requests faster than the server produces responses, an attacker can force the connection queue to grow indefinitely. This excessive memory consumption exhausts heap memory and crashes the Java Virtual Machine (JVM).
Statement
A flaw was found in Netty's WebSocketServerExtensionHandler where an unbounded per-connection queue allows remote attackers to cause a denial of service. The handler adds an entry to its validExtensions queue for every inbound HTTP request but only removes entries when the application writes responses, with no size limit enforced. An unauthenticated attacker can use HTTP/1.1 pipelining to send requests faster than the server produces responses, causing the queue to grow until heap exhaustion triggers OutOfMemoryError. This affects servers using WebSocketServerCompressionHandler (permessage-deflate) on their HTTP port before any WebSocket upgrade or authentication occurs.
Mitigation
Update to io.netty:netty-codec-http version 4.1.138.Final or 4.2.18.Final or later, which introduces bounds on the per-connection queue in WebSocketServerExtensionHandler to prevent unbounded memory growth.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | N/A | 5.3 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | Low | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
