Listen to this Post
When WebSocket compression is enabled in AsyncHttpClient via setEnablewebSocketCompression(true), the application installs Netty’s shared WebSocketClientCompressionHandler.INSTANCE. Because the frame aggregator sits in front of the inflater in the inbound pipeline, existing configuration parameters like webSocketMaxFrameSize and webSocketMaxBufferSize only limit the size of compressed bytes rather than the final decompressed payload. Consequently, a malicious server or network attacker can send a small compressed message (such as 2 MiB) that expands massively during inflation (up to 2 GiB) past any safety boundaries. The client allocates an enormous Netty buffer to handle the inflated payload and copies it again for the listener, which completely exhausts the JVM heap. Although Netty catches the resulting OutOfMemoryError and shuts down the specific connection, concurrent allocations across the application can fail while the buffer remains live, enabling continuous denial-of-service attacks via repeated memory exhaustion cycles.
DailyCVE Form:
Platform: AsyncHttpClient Java Library
Version: 3.0.13 and prior
Vulnerability : Decompression Bomb DoS
Severity: High
date: 2026-10-07
Prediction: 2026-10-07
What Undercode Say
Analytics
The vulnerability stems from an architectural mismatch in the Netty-based inbound pipeline where frame aggregation occurs prior to message decompression. Because Netty’s shared WebSocketClientCompressionHandler.INSTANCE is instantiated with an unbounded allocation limit (maxAllocation = 0), incoming frames compressed with permessage-deflate bypass size constraints during the inflation phase. This allows data amplification anomalies where tiny payloads translate to gigabyte-scale memory allocations, triggering severe Java heap exhaustion and application-wide denial of service.
Exploit: (Educational Purposes!)
// Conceptual demonstration of crafting a highly compressed WebSocket payload byte[] payload = new byte[2 1024 1024]; // 2 MiB small compressed frame // Expands to ~2 GiB upon inflation in vulnerable Netty pipelines WebSocketFrame frame = new TextWebSocketFrame(Unpooled.wrappedBuffer(compressedData)); channel.writeAndFlush(frame);
Protection: from this CVE
Upgrade AsyncHttpClient to version 3.0.14 or later, where the new configuration property webSocketMaxDecompressedFrameSize correctly enforces strict limits on decompressed payloads. Alternatively, keep WebSocket compression disabled by default using setEnablewebSocketCompression(false) if compression is not strictly required.
Impact
Applications utilizing vulnerable versions of AsyncHttpClient with WebSocket compression enabled are susceptible to remote denial of service. Attackers can trigger continuous JVM heap exhaustion and out-of-memory errors by sending maliciously crafted compressed WebSocket frames over untrusted connections, causing cascading memory allocation failures and application crashes.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
