Bug 2541839 (CVE-2026-100658)

Summary:	CVE-2026-100658 io.netty/netty-codec-http: Netty: Denial of Service via unbounded queue in WebSocketServerExtensionHandler
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	anthomas, ant, anujha, aschwart, asoldano, asyoung, aszczucz, ataylor, bbaranow, bbrownin, bmaxwell, boliveir, bstansbe, ccranfor, cescoffi, cmah, csuconic, dbruscin, dhanak, dlofthou, drichtar, drosa, dsimansk, ehelms, ehugonne, ewittman, fmariani, fmongiar, ggainey, gmalinko, gsmet, gtanzill, gtully, istudens, ivassile, iweiss, janstey, jbuscemi, jhollowa, jmartisk, jnethert, jpasqual, jpechane, jsherman, juwatts, jwon, kaycoth, kingland, kvanderr, manderse, mcarlett, mdellweg, mhulan, mnovotny, mosmerov, mposolda, msvehla, nipatil, nmoumoul, nwallace, olubyans, osousa, ozzy, pantinor, pberan, pcreech, pdelbell, pesilva, pjindal, pmackay, prichard, rchan, rgemmell, rgodfrey, rguimara, rkubis, rmartinc, rstancel, rstepani, sausingh, sbiarozk, sdawley, smallamp, ssilvert, sthirugn, sthorger, tbish, tcunning, thjenkin, tlavocat, tmalecek, varjain, vdosoudi, vmuzikar, yfang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Netty. An unbounded memory queue in the WebSocket server extension handler allows an unauthenticated remote attacker to cause a Denial of Service (DoS). By sending pipelined HTTP requests faster than the server produces responses, an attacker can force the connection queue to grow indefinitely. This excessive memory consumption exhausts heap memory and crashes the Java Virtual Machine (JVM).	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-26 13:34:22 UTC

Netty (io.netty:netty-codec-http) contains an unbounded per-connection queue in WebSocketServerExtensionHandler. The handler offers an entry to its per-channel validExtensions queue for every inbound HttpRequest, but polls an entry only when the application writes an HttpResponse, and the queue size is never bounded. A remote, unauthenticated peer can use HTTP/1.1 pipelining to send requests faster than the application produces responses — including plain non-upgrade HTTP requests to any path — causing the queue to grow without limit until the JVM exhausts heap memory and terminates with OutOfMemoryError. Because the affected handler is the base class of WebSocketServerCompressionHandler, any server that enables permessage-deflate is exposed on its plain HTTP port before any WebSocket upgrade completes and before any application-level authentication. Affected versions are 4.1.88.Final through 4.1.137.Final and 4.2.0.Final through 4.2.17.Final; the issue is fixed in 4.1.138.Final and 4.2.18.Final.