{"id":"CVE-2026-107227","aliases":["CLSA-2026-1792058129","CLSA-2026-1793887823","CLSA-2026-1794483990","DEBIAN-CVE-2026-107227","EUVD-2026-94588","GHSA-x8v2-478q-2hvg","ROOT-APP-MAVEN-CVE-2026-107227","UBUNTU-CVE-2026-107227"],"status":"published","title":"AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled","description":"The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.2.0 until 3.0.14, WebSocket permessage-deflate decompression is unbounded when compression is enabled. The inbound pipeline aggregates compressed frames before WebSocketClientCompressionHandler inflates them, so webSocketMaxFrameSize and webSocketMaxBufferSize do not bound decompressed output. A malicious WebSocket peer can send a small compressed message that expands to a very large Netty buffer and exhausts JVM heap. This issue is fixed in version 3.0.14.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00426,"percentile":0.37356,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-409"],"published":"2026-10-07T20:51:04Z","modified":"2026-11-12T19:30:06Z","fixes":[{"ecosystem":"Maven","package":"org.asynchttpclient:async-http-client","fixed_in":["3.0.14"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client","fixed_in":["2.3.0-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.asynchttpclient:async-http-client","fixed_in":["2.15.0-aikido.1","3.0.10-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.asynchttpclient:async-http-client","fixed_in":["2.15.0-root.io.1","3.0.10-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.asynchttpclient:async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"last_affected":"3.0.13"},{"fixed":"3.0.14"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.asynchttpclient:async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"last_affected":"2.16.1"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.1"},{"fixed":"2.12.1-tuxcare.2"}]}],"versions":["2.12.1","2.12.1-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.3"},{"fixed":"2.12.3-tuxcare.2"}]}],"versions":["2.12.3","2.12.3-tuxcare.1"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.3"},{"fixed":"2.12.3-tuxcare.2"}]}],"versions":["2.12.3","2.12.3-tuxcare.1"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-example","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.3"},{"fixed":"2.12.3-tuxcare.2"}]}],"versions":["2.12.3","2.12.3-tuxcare.1"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-extras-guava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.3"},{"fixed":"2.12.3-tuxcare.2"}]}],"versions":["2.12.3","2.12.3-tuxcare.1"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-extras-jdeferred","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.3"},{"fixed":"2.12.3-tuxcare.2"}]}],"versions":["2.12.3","2.12.3-tuxcare.1"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-extras-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.3"},{"fixed":"2.12.3-tuxcare.2"}]}],"versions":["2.12.3","2.12.3-tuxcare.1"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-extras-registry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.3"},{"fixed":"2.12.3-tuxcare.2"}]}],"versions":["2.12.3","2.12.3-tuxcare.1"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-extras-retrofit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.3"},{"fixed":"2.12.3-tuxcare.2"}]}],"versions":["2.12.3","2.12.3-tuxcare.1"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-extras-rxjava","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.3"},{"fixed":"2.12.3-tuxcare.2"}]}],"versions":["2.12.3","2.12.3-tuxcare.1"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-extras-rxjava2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.3"},{"fixed":"2.12.3-tuxcare.2"}]}],"versions":["2.12.3","2.12.3-tuxcare.1"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-extras-simple","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.3"},{"fixed":"2.12.3-tuxcare.2"}]}],"versions":["2.12.3","2.12.3-tuxcare.1"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-extras-typesafe-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.3"},{"fixed":"2.12.3-tuxcare.2"}]}],"versions":["2.12.3","2.12.3-tuxcare.1"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-netty-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.3"},{"fixed":"2.12.3-tuxcare.2"}]}],"versions":["2.12.3","2.12.3-tuxcare.1"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client-project","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.3"},{"fixed":"2.12.3-tuxcare.2"}]}],"versions":["2.12.3","2.12.3-tuxcare.1"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.asynchttpclient:async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.0-tuxcare.2"}]}],"versions":["2.3.0","2.3.0-tuxcare.1"]},{"source":"osv","ecosystem":"Debian:12","package":"async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12.3-1","2.12.3-1+deb12u1"]},{"source":"osv","ecosystem":"Maven","package":"org.asynchttpclient:async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.14"}]}],"versions":["3.0.0","3.0.1","3.0.10","3.0.11","3.0.12","3.0.13","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9"]},{"source":"osv","ecosystem":"Maven","package":"org.asynchttpclient:async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"last_affected":"2.16.1"}]}],"versions":["2.10.0","2.10.1","2.10.2","2.10.3","2.10.4","2.10.5","2.11.0","2.12.0","2.12.1","2.12.2","2.12.3","2.12.4","2.14.5","2.15.0","2.16.0","2.16.1","2.2.0","2.2.1","2.3.0","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.4.7","2.4.8","2.4.9","2.5.0","2.5.1","2.5.2","2.5.3","2.5.4","2.6.0","2.7.0","2.8.0","2.8.1","2.9.0"]},{"source":"osv","ecosystem":"Root:Maven","package":"org.asynchttpclient:async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.0-aikido.1"},{"fixed":"3.0.10-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.asynchttpclient:async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.0-root.io.1"},{"fixed":"3.0.10-root.io.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.5-1","1.6.5-2","1.6.5-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.5-4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.5-4","1.6.5-5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.0-1","2.6.0-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12.2-1","2.12.3-1","2.12.3-1ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12.3-1","2.12.3-1ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12.3-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"async-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12.3-1","2.12.3-1ubuntu1","2.12.3-1ubuntu1.1"]}],"products":[{"vendor":"asynchttpclient","product":"async-http-client"}],"references":[{"url":"https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-x8v2-478q-2hvg","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/AsyncHttpClient/async-http-client/commit/b61637f30327f314b7693418f12ce141ac6b2b30","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.14","tags":["x_refsource_MISC","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107227","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-x8v2-478q-2hvg"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107227.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-107227","tags":["advisory"]},{"url":"https://github.com/AsyncHttpClient/async-http-client","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-107227","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-107227","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-107227","title":"AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled","description":"The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.2.0 until 3.0.14, WebSocket permessage-deflate decompression is unbounded when compression is enabled. The inbound pipeline aggregates compressed frames before WebSocketClientCompressionHandler inflates them, so webSocketMaxFrameSize and webSocketMaxBufferSize do not bound decompressed output. A malicious WebSocket peer can send a small compressed message that expands to a very large Netty buffer and exhausts JVM heap. This issue is fixed in version 3.0.14.","status":"published","published":"2026-10-07T20:51:04.823Z","modified":"2026-10-08T14:02:28.739Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-400","CWE-409"],"updated_at":"2026-11-02T13:45:14.072357Z"}],"euvd":[{"id":"EUVD-2026-94588","description":"The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.2.0 until 3.0.14, WebSocket permessage-deflate decompression is unbounded when compression is enabled. The inbound pipeline aggregates compressed frames before WebSocketClientCompressionHandler inflates them, so webSocketMaxFrameSize and webSocketMaxBufferSize do not bound decompressed output. A malicious WebSocket peer can send a small compressed message that expands to a very large Netty buffer and exhausts JVM heap. This issue is fixed in version 3.0.14.","status":"published","published":"2026-10-07T20:51:04Z","modified":"2026-10-08T14:02:28Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T17:27:32.642438Z"}],"ghsa":[{"id":"GHSA-x8v2-478q-2hvg","title":"AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled","description":"### Impact\n\nWith WebSocket compression enabled, the client inflates `permessage-deflate` messages with no limit on the decompressed size. It installed Netty's shared `WebSocketClientCompressionHandler.INSTANCE`, whose inflater is unbounded, and `webSocketMaxFrameSize` and `webSocketMaxBufferSize` only bound the compressed bytes, because the frame aggregator sits in front of the inflater.\n\nA malicious or compromised WebSocket server, or anyone on the path of a `ws://` connection, can therefore send a message of about 2 MiB that inflates to about 2 GiB, the most a Netty buffer can hold. The client then copies the inflated message again to hand it to the listener. That exhausts the heap of a typically sized JVM. Netty catches the resulting `OutOfMemoryError` and closes that connection, but while the buffer is live any other allocation in the process can fail too, and a server that keeps sending such messages, on one connection or several, keeps the client at heap exhaustion.\n\n### Who is Impacted\n\nOnly applications that enable WebSocket compression with `setEnablewebSocketCompression(true)`, which is off by default, and connect to a WebSocket server that is untrusted, compromised, or reached over cleartext `ws://`.\n\n### Affected versions\n\n* 3.x: up to and including 3.0.13\n* 2.x: from 2.2.0, when WebSocket compression was added, up to and including 2.16.1\n\n### Patches\n\nFixed in 3.0.14. A new setting, `webSocketMaxDecompressedFrameSize` (`setWebSocketMaxDecompressedFrameSize`, or the `org.asynchttpclient.webSocketMaxDecompressedFrameSize` property), bounds how far a message may inflate, and a message that would go past it fails the connection. It defaults to 128000000 bytes, the same as `webSocketMaxBufferSize`, so a message is bounded alike whether or not it was compressed; a compressed message that inflates past that, which was accepted before, now fails the connection. With `aggregateWebSocketFrameFragments` turned off, the bound applies to each frame instead, and fragments are delivered one at a time. Set it lower if you enable compression and do not expect large messages. `0` disables the limit.\n\nThe 2.x line is end of life and will not receive a fix. Upgrade to 3.0.14.\n\n### Workarounds\n\nLeave WebSocket compression disabled, which is the default.\n\n### Details\n\nAfter the handshake the inbound pipeline is `ws-decoder`, `ws-aggregator`, `PerMessageDeflateDecoder`, `ahc-ws`: the aggregator, which enforces `webSocketMaxBufferSize`, sees each message before it is inflated. `WebSocketClientCompressionHandler.INSTANCE` is built with `maxAllocation = 0`, which Netty treats as unbounded, and Netty has deprecated it in favour of a constructor that takes a limit. RFC 6455 Section 10.4 asks an implementation to limit the size of a message after reassembly, and under RFC 7692 Section 6.2 the message delivered to the application is the decompressed payload.\n\nThis is a different path from the HTTP response decompression fixed under CVE-2026-85721, which never reached the WebSocket pipeline.\n\n### Attribution\n\nAI-assisted tools were used to support discovery and analysis.","status":"published","published":"2026-10-08T16:49:53Z","modified":"2026-10-08T16:49:54Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-409"],"updated_at":"2026-11-02T14:41:29.107536Z"}],"nvd":[{"id":"CVE-2026-107227","description":"The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.2.0 until 3.0.14, WebSocket permessage-deflate decompression is unbounded when compression is enabled. The inbound pipeline aggregates compressed frames before WebSocketClientCompressionHandler inflates them, so webSocketMaxFrameSize and webSocketMaxBufferSize do not bound decompressed output. A malicious WebSocket peer can send a small compressed message that expands to a very large Netty buffer and exhausts JVM heap. This issue is fixed in version 3.0.14.","status":"published","published":"2026-10-07T21:17:14.283Z","modified":"2026-10-08T20:35:31.2Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400","CWE-409"],"updated_at":"2026-11-02T14:12:55.142936Z"}],"osv":[{"id":"CVE-2026-107227","title":"AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled","description":"The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.2.0 until 3.0.14, WebSocket permessage-deflate decompression is unbounded when compression is enabled. The inbound pipeline aggregates compressed frames before WebSocketClientCompressionHandler inflates them, so webSocketMaxFrameSize and webSocketMaxBufferSize do not bound decompressed output. A malicious WebSocket peer can send a small compressed message that expands to a very large Netty buffer and exhausts JVM heap. This issue is fixed in version 3.0.14.","status":"published","published":"2026-10-07T20:51:04.823Z","modified":"2026-10-28T10:51:07.028286227Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-409"],"updated_at":"2026-11-02T15:44:54.933106Z"},{"id":"DEBIAN-CVE-2026-107227","description":"The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.2.0 until 3.0.14, WebSocket permessage-deflate decompression is unbounded when compression is enabled. The inbound pipeline aggregates compressed frames before WebSocketClientCompressionHandler inflates them, so webSocketMaxFrameSize and webSocketMaxBufferSize do not bound decompressed output. A malicious WebSocket peer can send a small compressed message that expands to a very large Netty buffer and exhausts JVM heap. This issue is fixed in version 3.0.14.","status":"published","published":"2026-10-07T21:17:14.283Z","modified":"2026-10-12T19:47:21.385873472Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:49.381767Z"},{"id":"GHSA-x8v2-478q-2hvg","title":"AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled","description":"### Impact\n\nWith WebSocket compression enabled, the client inflates `permessage-deflate` messages with no limit on the decompressed size. It installed Netty's shared `WebSocketClientCompressionHandler.INSTANCE`, whose inflater is unbounded, and `webSocketMaxFrameSize` and `webSocketMaxBufferSize` only bound the compressed bytes, because the frame aggregator sits in front of the inflater.\n\nA malicious or compromised WebSocket server, or anyone on the path of a `ws://` connection, can therefore send a message of about 2 MiB that inflates to about 2 GiB, the most a Netty buffer can hold. The client then copies the inflated message again to hand it to the listener. That exhausts the heap of a typically sized JVM. Netty catches the resulting `OutOfMemoryError` and closes that connection, but while the buffer is live any other allocation in the process can fail too, and a server that keeps sending such messages, on one connection or several, keeps the client at heap exhaustion.\n\n### Who is Impacted\n\nOnly applications that enable WebSocket compression with `setEnablewebSocketCompression(true)`, which is off by default, and connect to a WebSocket server that is untrusted, compromised, or reached over cleartext `ws://`.\n\n### Affected versions\n\n* 3.x: up to and including 3.0.13\n* 2.x: from 2.2.0, when WebSocket compression was added, up to and including 2.16.1\n\n### Patches\n\nFixed in 3.0.14. A new setting, `webSocketMaxDecompressedFrameSize` (`setWebSocketMaxDecompressedFrameSize`, or the `org.asynchttpclient.webSocketMaxDecompressedFrameSize` property), bounds how far a message may inflate, and a message that would go past it fails the connection. It defaults to 128000000 bytes, the same as `webSocketMaxBufferSize`, so a message is bounded alike whether or not it was compressed; a compressed message that inflates past that, which was accepted before, now fails the connection. With `aggregateWebSocketFrameFragments` turned off, the bound applies to each frame instead, and fragments are delivered one at a time. Set it lower if you enable compression and do not expect large messages. `0` disables the limit.\n\nThe 2.x line is end of life and will not receive a fix. Upgrade to 3.0.14.\n\n### Workarounds\n\nLeave WebSocket compression disabled, which is the default.\n\n### Details\n\nAfter the handshake the inbound pipeline is `ws-decoder`, `ws-aggregator`, `PerMessageDeflateDecoder`, `ahc-ws`: the aggregator, which enforces `webSocketMaxBufferSize`, sees each message before it is inflated. `WebSocketClientCompressionHandler.INSTANCE` is built with `maxAllocation = 0`, which Netty treats as unbounded, and Netty has deprecated it in favour of a constructor that takes a limit. RFC 6455 Section 10.4 asks an implementation to limit the size of a message after reassembly, and under RFC 7692 Section 6.2 the message delivered to the application is the decompressed payload.\n\nThis is a different path from the HTTP response decompression fixed under CVE-2026-85721, which never reached the WebSocket pipeline.\n\n### Attribution\n\nAI-assisted tools were used to support discovery and analysis.","status":"published","published":"2026-10-08T16:49:53Z","modified":"2026-10-08T17:00:11.871230703Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-409"],"updated_at":"2026-11-02T15:46:59.835583Z"},{"id":"UBUNTU-CVE-2026-107227","description":"The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.2.0 until 3.0.14, WebSocket permessage-deflate decompression is unbounded when compression is enabled. The inbound pipeline aggregates compressed frames before WebSocketClientCompressionHandler inflates them, so webSocketMaxFrameSize and webSocketMaxBufferSize do not bound decompressed output. A malicious WebSocket peer can send a small compressed message that expands to a very large Netty buffer and exhausts JVM heap. This issue is fixed in version 3.0.14.","status":"published","published":"2026-10-07T21:17:00Z","modified":"2026-10-17T12:59:48.13851284Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:59.130573Z"},{"id":"CLSA-2026-1792058129","title":"TuxCare security update for org.asynchttpclient:async-http-client (3 CVEs)","description":"TuxCare rebuilt org.asynchttpclient:async-http-client to address 3 CVEs. Fixed in 2.12.1-tuxcare.2.","status":"published","published":"2026-10-15T09:55:29Z","modified":"2026-11-02T19:46:28.42070231Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1793887823","title":"TuxCare security update for org.asynchttpclient (16 CVEs)","description":"TuxCare rebuilt 14 org.asynchttpclient packages to address 16 CVEs. Fixed in 2.12.3-tuxcare.2.","status":"published","published":"2026-11-05T15:10:25Z","modified":"2026-11-06T13:15:13.773820413Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1794483990","title":"TuxCare security update for org.asynchttpclient:async-http-client (1 CVE)","description":"TuxCare rebuilt org.asynchttpclient:async-http-client to address 1 CVE. Fixed in 2.3.0-tuxcare.2.","status":"published","published":"2026-11-12T12:46:30Z","modified":"2026-11-12T19:30:06.084886181Z","updated_at":"2026-11-12T19:43:48.38408Z"},{"id":"ROOT-APP-MAVEN-CVE-2026-107227","title":"CVE-2026-107227 in org.asynchttpclient:async-http-client - Patched by Root","description":"Root has patched CVE-2026-107227 in the org.asynchttpclient:async-http-client package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-10-26T15:14:37Z","modified":"2026-10-26T16:15:24.196463665Z","updated_at":"2026-11-02T15:53:27.066589Z"}]}}