{"id":"CVE-2026-107227","published":"2026-10-07T21:17:14.283","lastModified":"2026-10-08T20:35:31.200","description":"The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.2.0 until 3.0.14, WebSocket permessage-deflate decompression is unbounded when compression is enabled. The inbound pipeline aggregates compressed frames before WebSocketClientCompressionHandler inflates them, so webSocketMaxFrameSize and webSocketMaxBufferSize do not bound decompressed output. A malicious WebSocket peer can send a small compressed message that expands to a very large Netty buffer and exhausts JVM heap. This issue is fixed in version 3.0.14.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-400","CWE-409"],"vendors":[],"products":[],"references":[{"url":"https://github.com/AsyncHttpClient/async-http-client/commit/b61637f30327f314b7693418f12ce141ac6b2b30","tags":[]},{"url":"https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.14","tags":[]},{"url":"https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-x8v2-478q-2hvg","tags":[]}],"exploitRefs":[{"url":"https://github.com/AsyncHttpClient/async-http-client/commit/b61637f30327f314b7693418f12ce141ac6b2b30","tags":[]},{"url":"https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.14","tags":[]},{"url":"https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-x8v2-478q-2hvg","tags":[]}],"hasPoc":true,"ai":{"summary":"The AsyncHttpClient library has an unbounded WebSocket decompression vulnerability where malicious peers can send small compressed messages that expand to huge Netty buffers, exhausting JVM heap memory. This affects versions 2.2.0 through 3.0.14.","exploitability":"Exploitation is relatively straightforward requiring only a malicious WebSocket peer to send compressed frames that decompress to oversized buffers, with no special preconditions needed.","blast_radius":"The vulnerability could impact any Java application using AsyncHttpClient with WebSocket compression enabled, potentially causing widespread heap exhaustion and application instability across affected systems.","remediation":"Upgrade to version 3.0.14 or later to fix the unbounded decompression issue.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["web","memory","websocket","java"],"model":"garnet-coder","analyzedAt":"2026-10-15T09:02:35.344Z"}}