Read the docs
TI-2026-69311 Aliases CVE-2026-107227GHSA-x8v2-478q-2hvg

Unbounded WebSocket decompression in AsyncHttpClient enables DoS

Priority LOW 39CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

AsyncHttpClient (async-http-client) versions 2.2.0 through 2.16.1 and 3.0.0 before 3.0.14 are affected. WebSocket permessage-deflate decompression is unbounded when compression is enabled, because compressed frames are aggregated before they are inflated, so the configured frame and buffer size limits do not cap the decompressed output (CWE-409). A remote malicious WebSocket peer can send a small compressed message that expands to a very large buffer and exhausts JVM heap.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.2.0 until 3.0.14, WebSocket permessage-deflate decompression is unbounded when compression is enabled. The inbound pipeline aggregates compressed frames before WebSocketClientCompressionHandler inflates them, so webSocketMaxFrameSize and webSocketMaxBufferSize do not bound decompressed output. A malicious WebSocket peer can send a small compressed message that expands to a very large Netty buffer and exhausts JVM heap. This issue is fixed in version 3.0.14.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00426 37th percentileScored 2026-11-07
Fix Fixed async-http-client (AsyncHttpClient): 3.0.14org.asynchttpclient:async-http-client (Maven): 3.0.14

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AsyncHttpClientasync-http-client3.0.0 to before 3.0.14; 2.2.0 – 2.16.13.0.14Patch availableCNA
—org.asynchttpclient:async-http-client (Maven)3.0.0 to before 3.0.143.0.14Patch availableGHSA-x8v2-478q-2hvg
—org.asynchttpclient:async-http-client (Maven)2.2.0 – 2.16.1—No fix listedGHSA-x8v2-478q-2hvg
  • async-http-client VendorAsyncHttpClient Affected 3.0.0 to before 3.0.14; 2.2.0 – 2.16.1 Fixed in 3.0.14 Patch available CNA
  • org.asynchttpclient:async-http-client (Maven) Vendor— Affected 3.0.0 to before 3.0.14 Fixed in 3.0.14 Patch available GHSA-x8v2-478q-2hvg
  • org.asynchttpclient:async-http-client (Maven) Vendor— Affected 2.2.0 – 2.16.1 Fixed in — No fix listed GHSA-x8v2-478q-2hvg

Remediation

Upgrade org.asynchttpclient:async-http-client to version 3.0.14, which contains the fix. The sources list no fixed version for async-http-client 2.x releases.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA async-http-client (AsyncHttpClient) Fixed in 3.0.14
  • Fix · GHSA-x8v2-478q-2hvg org.asynchttpclient:async-http-client (Maven) Fixed in 3.0.14 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat Fuse 7

Timeline

  1. 2026-10-07 Threatist record created from CVE-2026-107227
  2. 2026-10-08 CISA SSVC decision points changed
  3. 2026-10-08 Priority changed: MEDIUM → LOW
  4. 2026-10-08 Alias added: GHSA-x8v2-478q-2hvg
  5. 2026-10-08 Fix available: Maven/org.asynchttpclient:[email protected] · GHSA-x8v2-478q-2hvg
  6. 2026-10-08 CVSS score added · GHSA-x8v2-478q-2hvg
  7. 2026-10-08 Weakness changed · GHSA-x8v2-478q-2hvg
  8. 2026-10-08 5 new references · GHSA-x8v2-478q-2hvg
  9. 2026-10-09 Affected versions changed · Red Hat
  10. 2026-10-09 CVSS score added · Red Hat

References

Advisory 1

Other 4

  • TI-2024-36149 AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s CVSS 4.0CRITICAL 9.2
  • TI-2026-69321 Cross-host replay in AsyncHttpClient leaks credentials to new host CVSS 4.0CRITICAL 9.4
  • TI-2026-69315 AsyncHttpClient sends passwords in cleartext after Digest downgrade CVSS 4.0HIGH 8.7
  • TI-2026-58825 AsyncHttpClient: Unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service CVSS 3.1HIGH 7.5
  • TI-2026-58823 AsyncHttpClient: SOCKS proxy credentials sent to the origin server over plaintext HTTP CVSS 3.1HIGH 7.5
  • TI-2026-69317 AsyncHttpClient skips Digest mutual authentication for qop=auth-int CVSS 4.0HIGH 8.8
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences