ECHO-5640-40fe-97dc
See a problem?- Import Source
- https://advisory.echohq.com/osv/ECHO-5640-40fe-97dc.json
- JSON Data
- https://api.osv.dev/v1/vulns/ECHO-5640-40fe-97dc
- Upstream
- CVE-2026-100658
- GHSA-7fpc-p5rc-xwr5
- Withdrawn
- 2026-11-05T12:11:55Z
- Published
- 2026-11-01T08:55:31Z
- Modified
- 2026-11-05T12:45:02Z
- Summary
- GHSA-2g37-3h88-55hc: WebSocketServerExtensionHandler's per-connection queue of negotiated extensions grows without bound with pipelined requests. Upstream's fix (https://github.com/netty/netty/commit/3574f7ed7a, 4.1.138.Final) caps that queue, which was introduced in 4.1.88.Final (https://github.com/netty/netty/commit/f761ab5620, #13180). 4.1.74.Final has no queue there: the handler keeps a single List<WebSocketServerExtension> field that each new upgrade request overwrites, so it cannot grow per request.
- Details
- References
-
- https://advisory.echohq.com/cve/CVE-2026-100658
- https://github.com/netty/netty/security/advisories/GHSA-2g37-3h88-55hc
- https://nvd.nist.gov/vuln/detail/CVE-2026-100658
- https://www.vulncheck.com/advisories/netty-before-4.1.138-final-denial-of-service-via-websocketserverextensionhandler
- https://github.com/advisories/GHSA-7fpc-p5rc-xwr5