cyfenced.com →

[ CVE-2026-107227 · Published 7 Oct 2026 ]

AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled

CVSS 7.5 EPSS <1%Fix available

[ Description ]Official description

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.2.0 until 3.0.14, WebSocket permessage-deflate decompression is unbounded when compression is enabled. The inbound pipeline aggregates compressed frames before WebSocketClientCompressionHandler inflates them, so webSocketMaxFrameSize and webSocketMaxBufferSize do not bound decompressed output. A malicious WebSocket peer can send a small compressed message that expands to a very large Netty buffer and exhausts JVM heap. This issue is fixed in version 3.0.14.

[ Fixes ]Fixes and patches

[ Packages ]Affected open-source packages

  • org.asynchttpclient:async-http-client mavenAffected >= 3.0.0, <= 3.0.13 · fixed in 3.0.14 · GHSA-x8v2-478q-2hvg
  • org.asynchttpclient:async-http-client mavenAffected >= 2.2.0, <= 2.16.1 · GHSA-x8v2-478q-2hvg

[ References ]References