CVE-2026-107227

Summary

The AsyncHttpClient library has an unbounded WebSocket decompression vulnerability where malicious peers can send small compressed messages that expand to huge Netty buffers, exhausting JVM heap memory. This affects versions 2.2.0 through 3.0.14.

Exploitability

Exploitation is relatively straightforward requiring only a malicious WebSocket peer to send compressed frames that decompress to oversized buffers, with no special preconditions needed.

Blast radius

The vulnerability could impact any Java application using AsyncHttpClient with WebSocket compression enabled, potentially causing widespread heap exhaustion and application instability across affected systems.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 3.0.14 or later to fix the unbounded decompression issue.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.