{"schema":"threatline.record/2","record":{"id":"CVE-2026-107227","aliases":["GHSA-x8v2-478q-2hvg"],"summary":"AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled","details":"### Impact\n\nWith WebSocket compression enabled, the client inflates `permessage-deflate` messages with no limit on the decompressed size. It installed Netty's shared `WebSocketClientCompressionHandler.INSTANCE`, whose inflater is unbounded, and `webSocketMaxFrameSize` and `webSocketMaxBufferSize` only bound the compressed bytes, because the frame aggregator sits in front of the inflater.\n\nA malicious or compromised WebSocket server, or anyone on the path of a `ws://` connection, can therefore send a message of about 2 MiB that inflates to about 2 GiB, the most a Netty buffer can hold. The client then copies the inflated message again to hand it to the listener. That exhausts the heap of a typically sized JVM. Netty catches the resulting `OutOfMemoryError` and closes that connection, but while the buffer is live any other allocation in the process can fail too, and a server that keeps sending such messages, on one connection or several, keeps the client at heap exhaustion.\n\n### Who is Impacted\n\nOnly applications that enable WebSocket compression with `setEnablewebSocketCompression(true)`, which is off by default, and connect to a WebSocket server that is untrusted, compromised, or reached over cleartext `ws://`.\n\n### Affected versions\n\n* 3.x: up to and including 3.0.13\n* 2.x: from 2.2.0, when WebSocket compression was added, up to and including 2.16.1\n\n### Patches\n\nFixed in 3.0.14. A new setting, `webSocketMaxDecompressedFrameSize` (`setWebSocketMaxDecompressedFrameSize`, or the `org.asynchttpclient.webSocketMaxDecompressedFrameSize` property), bounds how far a message may inflate, and a message that would go past it fails the connection. It defaults to 128000000 bytes, the same as `webSocketMaxBufferSize`, so a message is bounded alike whether or not it was compressed; a compressed message that inflates past that, which was accepted before, now fails the connection. With `aggregateWebSocketFrameFragments` turned off, the bound applies to each frame instead, and fragments are delivered one at a time. Set it lower if you enable compression and do not expect large messages. `0` disables the limit.\n\nThe 2.x line is end of life and will not receive a fix. Upgrade to 3.0.14.\n\n### Workarounds\n\nLeave WebSocket compression disabled, which is the default.\n\n### Details\n\nAfter the handshake the inbound pipeline is `ws-decoder`, `ws-aggregator`, `PerMessageDeflateDecoder`, `ahc-ws`: the aggregator, which enforces `webSocketMaxBufferSize`, sees each message before it is inflated. `WebSocketClientCompressionHandler.INSTANCE` is built with `maxAllocation = 0`, which Netty treats as unbounded, and Netty has deprecated it in favour of a constructor that takes a limit. RFC 6455 Section 10.4 asks an implementation to limit the size of a message after reassembly, and under RFC 7692 Section 6.2 the message delivered to the application is the decompressed payload.\n\nThis is a different path from the HTTP response decompression fixed under CVE-2026-85721, which never reached the WebSocket pipeline.\n\n### Attribution\n\nAI-assisted tools were used to support discovery and analysis.","categories":["Libraries & packages"],"product":"org.asynchttpclient:async-http-client","vendor":"AsyncHttpClient","ecosystem":"maven","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-x8v2-478q-2hvg","source_modified_at":"2026-10-08T16:49:54Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.asynchttpclient:async-http-client"},"range":">= 3.0.0, <= 3.0.13"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-x8v2-478q-2hvg","source_modified_at":"2026-10-08T16:49:54Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.asynchttpclient:async-http-client"},"range":">= 2.2.0, <= 2.16.1"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-107227","source_modified_at":"2026-10-08T14:02:28.739Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"async-http-client","vendor":"AsyncHttpClient","versions":[{"version":">= 3.0.0, < 3.0.14","status":"affected"},{"version":">= 2.2.0, <= 2.16.1","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-x8v2-478q-2hvg","source_modified_at":"2026-10-08T17:00:11.871230703Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.asynchttpclient:async-http-client","purl":"pkg:maven/org.asynchttpclient/async-http-client"},"ranges":[{"events":[{"introduced":"3.0.0"},{"fixed":"3.0.14"}],"type":"ECOSYSTEM"}],"versions":["3.0.0","3.0.1","3.0.10","3.0.11","3.0.12","3.0.13","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-x8v2-478q-2hvg","source_modified_at":"2026-10-08T17:00:11.871230703Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.asynchttpclient:async-http-client","purl":"pkg:maven/org.asynchttpclient/async-http-client"},"ranges":[{"events":[{"introduced":"2.2.0"},{"last_affected":"2.16.1"}],"type":"ECOSYSTEM"}],"versions":["2.10.0","2.10.1","2.10.2","2.10.3","2.10.4","2.10.5","2.11.0","2.12.0","2.12.1","2.12.2","2.12.3","2.12.4","2.14.5","2.15.0","2.16.0","2.16.1","2.2.0","2.2.1","2.3.0","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.4.7","2.4.8","2.4.9","2.5.0","2.5.1","2.5.2","2.5.3","2.5.4","2.6.0","2.7.0","2.8.0","2.8.1","2.9.0"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-x8v2-478q-2hvg","source_modified_at":"2026-10-08T16:49:54Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.asynchttpclient:async-http-client"},"version":"3.0.14"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-x8v2-478q-2hvg","source_modified_at":"2026-10-08T17:00:11.871230703Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.asynchttpclient:async-http-client","purl":"pkg:maven/org.asynchttpclient/async-http-client"},"version":"3.0.14"}],"cvss":7.5,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00432,"percentile":0.36386,"score_date":"2026-10-23"},"published_at":"2026-10-07T20:51:04.823Z","modified_at":"2026-10-08T17:00:11.871230703Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-x8v2-478q-2hvg","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-08T16:49:54Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-107227","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-08T14:02:28.739Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-x8v2-478q-2hvg","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-08T17:00:11.871230703Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107227","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-x8v2-478q-2hvg","tags":["x_refsource_CONFIRM"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107227","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/AsyncHttpClient/async-http-client/commit/b61637f30327f314b7693418f12ce141ac6b2b30","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.14","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-x8v2-478q-2hvg","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","assessed_at":"2026-10-08T14:02:20.681705Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-08T17:00:11.871230703Z","content_hash":"f0f8411ca12b113c4dfbf9e511173fa956dab4c39982d9c5f41b2f5887313aef"}}