CVE-2026-100658

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-100658
Rejected reason: This CVE ID has been rejected as a duplicate.
CVSS

No CVSS.

References

No reference.

Configurations

No configuration.

History

28 Sep 2026, 22:17

Type Values Removed Values Added
References
  • {'url': 'https://github.com/netty/netty/security/advisories/GHSA-2g37-3h88-55hc', 'source': 'disclosure@vulncheck.com'}
  • {'url': 'https://www.vulncheck.com/advisories/netty-before-4.1.138-final-denial-of-service-via-websocketserverextensionhandler', 'source': 'disclosure@vulncheck.com'}
CVSS v2 : unknown
v3 : 5.3 		v2 : unknown
v3 : unknown
CWE CWE-770
Summary (en) Netty (io.netty:netty-codec-http) contains an unbounded per-connection queue in WebSocketServerExtensionHandler. The handler offers an entry to its per-channel validExtensions queue for every inbound HttpRequest, but polls an entry only when the application writes an HttpResponse, and the queue size is never bounded. A remote, unauthenticated peer can use HTTP/1.1 pipelining to send requests faster than the application produces responses — including plain non-upgrade HTTP requests to any path — causing the queue to grow without limit until the JVM exhausts heap memory and terminates with OutOfMemoryError. Because the affected handler is the base class of WebSocketServerCompressionHandler, any server that enables permessage-deflate is exposed on its plain HTTP port before any WebSocket upgrade completes and before any application-level authentication. Affected versions are 4.1.88.Final through 4.1.137.Final and 4.2.0.Final through 4.2.17.Final; the issue is fixed in 4.1.138.Final and 4.2.18.Final. (en) Rejected reason: This CVE ID has been rejected as a duplicate.

26 Sep 2026, 14:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-09-26 14:16

Updated : 2026-09-28 22:17

NVD link : CVE-2026-100658

Mitre link : CVE-2026-100658

CVE.ORG link : CVE-2026-100658

JSON object : View

Products Affected

No product.

CWE

No CWE.