Findings

CVE-2026-107227

AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled

Published Oct 8, 2026 · updated Oct 8, 2026

### Impact With WebSocket compression enabled, the client inflates messages with no limit on the decompressed size. It installed Netty's shared , whose inflater is unbounded, and and only bound the compressed bytes, because the frame aggregator sits in front of the inflater. A malicious or compromised WebSocket server, or anyone on the path of a connection, can therefore send a message of about 2 MiB that inflates to about 2 GiB, the most a Netty buffer can hold. The client then copies the inflated message again to hand it to the listener. That exhausts the heap of a typically sized JVM. Netty catches the resulting and closes that connection, but while the buffer is live any other allocation in the process can fail too, and a server that keeps sending such messages, on one connection or several, keeps the client at heap exhaustion. ### Who is Impacted Only applications that enable WebSocket compression with , which is off by default, and connect to a WebSocket server that is untrusted, compromised, or reached over cleartext . ### Affected versions * 3.x: up to and including 3.0.13 * 2.x: from 2.2.0, when WebSocket compression was added, up to and including 2.16.1 ### Patches Fixed in 3.0.14. A new setting, ( , or the property), bounds how far a message may inflate, and a message that would go past it fails the connection. It defaults to 128000000 bytes, the same as , so a message is bounded alike whether or not it was compressed; a compressed message that inflates past that, which was accepted before, now fails the connection. With turned off, the bound applies to each frame instead, and fragments are delivered one at a time. Set it lower if you enable compression and do not expect large messages. disables the limit. The 2.x line is end of life and will not receive a fix. Upgrade to 3.0.14. ### Workarounds Leave WebSocket compression disabled, which is the default. ### Details After the handshake the inbound pipeline is , , , : the aggregator, which enforces , sees