Is CVE-2026-100658 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100658 being exploited in the wild.

How severe is CVE-2026-100658?

Medium severity, with a CVSS score of 5.3, published 26 September 2026.

Which products and versions are affected?

Netty-Codec-Http 4.1.88.Final through 4.1.137.Final, 4.2.0.Final through 4.2.17.Final.

Is there a fix for CVE-2026-100658?

A patch was published on 2026-09-26: Fixed in 4.1.138.Final and 4.2.18.Final Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-100658 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-100658?

Check whether you run Netty-Codec-Http at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100658: Netty unbounded queue denial of service in WebSocketServerExtensionHandler

CVE-2026-100658 · Severity: medium · CVSS 5.3 · Published 2026-09-26

Netty is a Java networking library used to build high-performance servers and client applications. A flaw in its WebSocket handler allows a remote attacker to send HTTP requests faster than the server responds, causing an unbounded queue to grow until the Java process runs out of memory and crashes, disrupting service. Any server using WebSocket compression or HTTP request handling is vulnerable, even before a WebSocket upgrade occurs.

Technologies: Netty-Codec-Http. Vendors: Netty.

Quick answers

Is CVE-2026-100658 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100658 being exploited in the wild.
How severe is CVE-2026-100658?: Medium severity, with a CVSS score of 5.3, published 26 September 2026.
Which products and versions are affected?: Netty-Codec-Http 4.1.88.Final through 4.1.137.Final, 4.2.0.Final through 4.2.17.Final.
Is there a fix for CVE-2026-100658?: A patch was published on 2026-09-26: Fixed in 4.1.138.Final and 4.2.18.Final Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100658 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-100658?: Check whether you run Netty-Codec-Http at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

WebSocketServerExtensionHandler maintains an unbounded per-connection queue (validExtensions) that grows by one entry for every inbound HttpRequest but drains only when the application writes an HttpResponse. An attacker can exploit HTTP/1.1 pipelining to send requests faster than responses are generated, causing the queue to grow without limit and exhaust heap memory (OutOfMemoryError). The vulnerability is pre-authentication and affects all HTTP traffic on the port, not just WebSocket upgrades.

Affected products

Netty netty-codec-http 4.1.88.Final through 4.1.137.Final, 4.2.0.Final through 4.2.17.Final

Timeline

2026-09-26: disclosed
2026-09-26: patched: Fixed in 4.1.138.Final and 4.2.18.Final

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.