CVE-2026-100658 netty CVE debrief

Who should care

Defenders responsible for Netty-based servers, particularly those enabling permessage-deflate, should assess exposure and apply patches. This vulnerability can be exploited before authentication, making it a priority for servers with publicly accessible HTTP ports.

Why it matters

CVE-2026-100658 is a denial-of-service vulnerability in Netty's WebSocketServerExtensionHandler. Defenders should prioritize verifying exposure and applying patches, as this vulnerability can be exploited before authentication, potentially leading to OutOfMemoryError and JVM termination.

• Potential OutOfMemoryError and JVM termination.
• Denial-of-service vulnerability before authentication.
• Exposure on plain HTTP port before WebSocket upgrade completes.
• Verification of affected versions and patch application required.

Technical summary

The WebSocketServerExtensionHandler in Netty contains an unbounded per-connection queue. A remote, unauthenticated peer can use HTTP/1.1 pipelining to send requests faster than the application produces responses, causing the queue to grow without limit. This can lead to a potential OutOfMemoryError and JVM termination. The issue affects servers that enable permessage-deflate on their plain HTTP port before any WebSocket upgrade completes and before any application-level authentication. Affected versions are 4.1.88.Final through 4.1.137.Final and 4.2.0.Final through 4.2.17.Final; the issue is fixed in 4.1.138.Final and 4.2.18.Final. Defenders should prioritize verifying exposure and applying patches.

Defensive priority

Defenders should prioritize verifying exposure and applying patches, as this vulnerability can be exploited before authentication.

Recommended defensive actions

• Verify if the server is using an affected version of Netty (4.1.88.Final through 4.1.137.Final or 4.2.0.Final through 4.2.17.Final).
• Check if permessage-deflate is enabled on the plain HTTP port.
• Apply patches to upgrade to 4.1.138.Final or 4.2.18.Final.
• Monitor for potential OutOfMemoryError and JVM termination.
• Consider implementing compensating controls, such as rate limiting or IP blocking.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and fixed versions. However, the corpus does not establish specific exploitation instances or impact. Defenders should verify if the server is using an affected version of Netty (4.1.88.Final through 4.1.137.Final or 4.2.0.Final through 4.2.17.Final) and check if permessage-deflate is enabled on the plain HTTP port. The CVE Program and NVD entries serve as primary sources for this information. Additional verification tasks may be necessary to confirm

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.