{"id":"ECHO-5640-40fe-97dc","summary":"GHSA-2g37-3h88-55hc: WebSocketServerExtensionHandler's per-connection queue of negotiated\nextensions grows without bound with pipelined requests. Upstream's fix\n(https://github.com/netty/netty/commit/3574f7ed7a, 4.1.138.Final) caps that queue, which was\nintroduced in 4.1.88.Final (https://github.com/netty/netty/commit/f761ab5620, #13180).\n4.1.74.Final has no queue there: the handler keeps a single List\u003cWebSocketServerExtension\u003e\nfield that each new upgrade request overwrites, so it cannot grow per request.\n","modified":"2026-11-05T12:45:02.848310744Z","published":"2026-11-01T08:55:31.927Z","withdrawn":"2026-11-05T12:11:55.186Z","upstream":["CVE-2026-100658","GHSA-7fpc-p5rc-xwr5"],"references":[{"type":"WEB","url":"https://advisory.echohq.com/cve/CVE-2026-100658"},{"type":"WEB","url":"https://github.com/netty/netty/security/advisories/GHSA-2g37-3h88-55hc"},{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100658"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/netty-before-4.1.138-final-denial-of-service-via-websocketserverextensionhandler"},{"type":"WEB","url":"https://github.com/advisories/GHSA-7fpc-p5rc-xwr5"}],"affected":[{"package":{"name":"io.netty:netty-codec-http","ecosystem":"Echo:Maven","purl":"pkg:maven/io.netty/netty-codec-http"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.74.Final+echo.6"}]}],"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-5640-40fe-97dc.json"}}],"schema_version":"1.9.2"}