Executive brief
Netty is an open-source Java networking library used by many applications to handle high-performance network communication. A vulnerability in its WebSocket handler allows an unauthenticated attacker to send specially crafted HTTP requests that accumulate in a queue faster than the server can process them, eventually exhausting the server's memory and causing it to crash, resulting in service downtime.
Technical details
The vulnerability exists in Netty's WebSocketServerExtensionHandler component and involves improper handling of HTTP/1.1 pipelined requests. An attacker can exploit this by sending multiple HTTP requests in rapid succession over a single connection, causing them to queue unbounded in memory. The handler fails to properly limit queue growth, leading to heap exhaustion in the Java Virtual Machine and a denial-of-service condition. No authentication is required; the attack is triggered via network-accessible HTTP requests. A patch addressing queue management should be available from the Netty project.
Affected products
- Netty Netty <UNKNOWN>
Timeline
- 2026-09-18: disclosed