AsyncHttpClient WebSocket permessage-deflate decompression bomb DoS (CVE-2026-107227)

Vulnerability Overview Vulnerability Name: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled Vulnerability Description: When WebSocket compression is enabled, clients allow unlimited expansion of the decompressed size of messages. This can lead to memory exhaustion, resulting in a denial-of-service attack. Scope of Impact Affected Versions: - (Maven) - >= 3.0.0, = 2.2.0, <= 2.16.1 Affected Conditions: - Only affected when WebSocket compression is enabled (via ). - Potentially vulnerable when connecting to untrusted, compromised, or plaintext-transmitting WebSocket servers. Remediation Fixed Version: 3.0.14 Patch Details: - Introduced a new setting (or the system property) to limit the decompressed message size. - The default value is 128,000,000 bytes (same as ), preventing messages from exceeding this limit after decompression. - If is set to , this limit applies to each individual frame fragment and is enforced upon each delivery. - Set this value if compression is enabled and large messages are expected; otherwise, disable the limit. Workaround: - Disable WebSocket compression (disabled by default). Additional Information CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality: None - Integrity: None - Availability: High CVE ID: CVE-2026-107227 Weaknesses: - CWE-400 - CWE-409 Contributors: - manus-pi - manus-use Detailed Information Technical Details: - After the handshake, the inbound pipeline includes , , , etc. - The property is intended to limit message size, but Netty treats it as unbounded in this context. - RFC 6455 Section 10.4 requires implementations to limit message size, and RFC 7692 Section 6.2 requires limiting the decompressed message size. Distinct Path: - This vulnerability is distinct from the HTTP response decompression vulnerability (CVE-2026-85721), which does not reach the WebSocket pipeline. Attribution Discovered and confirmed using AI-assisted tools.

Goal Reached Thanks to every supporter — we hit 100%!

AsyncHttpClient WebSocket permessage-deflate decompression bomb DoS (CVE-2026-107227)

More from this source