Riskcovery

CVE-2026-107227

AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled

State
Published
Severity
7.5 High
Published
Oct 7, 2026
Updated
Oct 8, 2026
Reserved
Oct 7, 2026

Read the record on cve.org

Description

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.2.0 until 3.0.14, WebSocket permessage-deflate decompression is unbounded when compression is enabled. The inbound pipeline aggregates compressed frames before WebSocketClientCompressionHandler inflates them, so webSocketMaxFrameSize and webSocketMaxBufferSize do not bound decompressed output. A malicious WebSocket peer can send a small compressed message that expands to a very large Netty buffer and exhausts JVM heap. This issue is fixed in version 3.0.14.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HGitHub_M

Weaknesses

  • CWE-400 Uncontrolled Resource Consumption
  • CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)

Affected Products

ProductVersions
async-http-clientAsyncHttpClient
  • >= 3.0.0, < 3.0.14Affected
  • >= 2.2.0, <= 2.16.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.