Executive brief
AsyncHttpClient, a popular Java library for making HTTP requests, decompresses response bodies without size limits by default. An attacker controlling or intercepting a server response can send a small compressed file that expands dramatically in memory, exhausting the client application's heap and crashing it. This impacts any application using AsyncHttpClient for external API calls or web requests.
Technical details
The vulnerability is a decompression-bomb denial of service in AsyncHttpClient's HTTP/1.1 response decompression path. The ChannelManager.newHttpContentDecompressor() method creates Netty's HttpContentDecompressor without any cumulative size bound; Netty's maxAllocation parameter only limits individual decode steps, not the total decompressed output. A remote attacker (or a compromised/hostile server) can send a small gzip-, deflate-, snappy-, brotli-, or zstd-compressed response that decompresses to massive size across multiple chunks, causing OutOfMemoryError. The fix, available in 3.0.12 and 2.16.1, tracks accumulated decompressed bytes per response and rejects bodies exceeding a configured limit. Versions 3.0.8–3.0.10 also have an unbounded HTTP/2 decompressor.
Affected products
- AsyncHttpClient AsyncHttpClient 3.x up to and including 3.0.11; 2.x up to and including 2.16.0
Timeline
- 2026-09-17: disclosed: GHSA-7grg-jcf7-rpmx published
- 2026-09-17: patched: Fixed in AsyncHttpClient 3.0.12 (3.x line) and 2.16.1 (2.x line)