CVE-2026-100658

Executive Summary

CVE-2026-100658 is an unbounded memory exhaustion vulnerability in Netty's WebSocketServerExtensionHandler (module io.netty:netty-codec-http). The handler offers an entry to a per-channel validExtensions queue for every inbound HTTP request but only polls entries when the application writes an HTTP response, and the queue is never bounded. A remote, unauthenticated attacker can exploit HTTP/1.1 pipelining to send requests faster than responses are produced, causing queue growth until JVM heap exhaustion and OutOfMemoryError termination. Any Netty-based server that enables the WebSocket permessage-deflate extension (via WebSocketServerCompressionHandler) is exposed on its plain HTTP port before any WebSocket upgrade and before application-level authentication.

Technical Analysis

The vulnerability resides in WebSocketServerExtensionHandler, the base class of WebSocketServerCompressionHandler. The root cause is a producer/consumer imbalance in the handler's per-channel validExtensions queue:

1. Producer side (unbounded): For every inbound HttpRequest, the handler offers an entry to the per-channel validExtensions queue. This includes plain, non-upgrade HTTP requests to any path — no WebSocket upgrade handshake is required.
2. Consumer side (rate-limited): The handler polls an entry from the queue only when the application writes an HttpResponse.
3. Missing bound: The queue size is never capped, so when the inbound request rate exceeds the application's response production rate, the queue grows without limit.

This is a classic CWE-770 (Allocation of Resources Without Limits or Throttling) condition. Because the vulnerable handler is the base class of WebSocketServerCompressionHandler, any server that enables permessage-deflate inherits the exposure — and the exposure exists on the plain HTTP port before any WebSocket upgrade completes and before any application-level authentication executes. The attack surface therefore includes the pre-authentication HTTP request path of exposed services.

The CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) reflects a network-reachable, low-complexity, unauthenticated, no-user-interaction flaw with scope unchanged and availability-only impact rated Low. The Low availability score reflects that the attacker degrades service by exhausting resources on the affected node rather than achieving total, persistent denial across scope.

Affected version ranges are 4.1.88.Final through 4.1.137.Final and 4.2.0.Final through 4.2.17.Final; the issue is fixed in 4.1.138.Final and 4.2.18.Final. Patch confidence is 0/4 — no patch evidence has been collected from any tracked source at the time of writing.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (unbounded resource allocation) and the mechanics described in the NVD entry.

1. Reconnaissance / target identification. The attacker identifies externally reachable services built on Netty that enable the WebSocket permessage-deflate extension. Fingerprinting relies on HTTP server banners/headers characteristic of Netty as well as service behavior on the plain HTTP port. Any path on the host is potentially useful because the trigger requires only ordinary HttpRequest traffic, not a WebSocket upgrade.

2. Triggering the flaw class. The attacker sends many HTTP/1.1 requests using HTTP/1.1 pipelining to increase the inbound request rate without waiting for responses. The WebSocketServerExtensionHandler offers an entry to the validExtensions queue for every such inbound request — including plain non-upgrade requests to any path. Because the response side is slower than the request side (or responses are deliberately withheld), entries accumulate in the per-channel queue, which is never bounded.

3. Payload / execution method. At the vulnerability-class level, the payload is sustained high-rate pipelined HTTP traffic rather than malformed input or code injection. No exploit code, function call, or memory-corruption technique is required: the flaw is triggered purely by exceeding the consumer rate of the validExtensions queue. The attacker does not need valid credentials because the exposure occurs before any WebSocket upgrade and before application-level authentication.

4. Post-exploitation impact. Continued queue growth consumes JVM heap until the process terminates with OutOfMemoryError. The result is denial of service for the affected Netty server instance. Because the exposure is at the pre-authentication HTTP layer, an unauthenticated remote peer can degrade availability of internet-facing services that enable permessage-deflate.

Impact Assessment

The business impact is availability degradation of Netty-based application servers exposed to untrusted networks. The CVSS v3.1 base score is 5.3 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L:

• AV:N — reachable over the network.
• AC:L — no special conditions beyond sending pipelined requests faster than responses are produced.
• PR:N / UI:N — no authentication or user interaction required; the flaw triggers on the plain HTTP port before any WebSocket upgrade and before application-level authentication.
• S:U — impact remains within the vulnerable component's security scope.
• C:N / I:N / A:L — no confidentiality or integrity impact; availability impact is rated Low, consistent with heap exhaustion terminating the process.

Blast radius: Any server that enables permessage-deflate (via WebSocketServerCompressionHandler) on Netty 4.1.88.Final–4.1.137.Final or 4.2.0.Final–4.2.17.Final. The affected surface is the HTTP listener itself, so unrelated endpoints on the same port are reachable as attack vectors. Sustained exploitation can cause repeated process restarts, capacity loss, and downstream failures across dependent services. There is no confirmed in-the-wild exploitation, no CISA KEV listing, no public PoC, and no Nuclei template at this time. EPSS has not yet been scored by FIRST.org.

Detection Guidance

Sigma Rule

title: Potential Netty WebSocketServerExtensionHandler Memory Exhaustion Attempt
id: 8f2a1c74-3b9e-4d51-9c0a-6e7d5b2f4a10
status: experimental
description: Detects sustained high-rate HTTP/1.1 pipelined request patterns against Netty-based services enabling permessage-deflate, consistent with CVE-2026-100658 validExtensions queue exhaustion.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100658
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1499
logsource:
  category: webserver
detection:
  selection_server:
    - cs-user-agent|contains: 'netty'
    - cs-host: '*'
  selection_pattern:
    cs-method: 'GET'
    sc-status: 200
  timeframe: 10s
  condition: selection_server and selection_pattern | count() by src_ip > 200
fields:
  - src_ip
  - cs-method
  - cs-uri-stem
falsepositives:
  - Legitimate high-volume load testing or health-check traffic
level: medium

YARA Rule

rule CVE_2026_100658_Netty_WebSocket_Queue_Exhaustion
{
    meta:
        description = "Detects Netty WebSocketServerExtensionHandler / WebSocketServerCompressionHandler references in application artifacts potentially affected by CVE-2026-100658"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100658"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $cls1 = "WebSocketServerExtensionHandler" ascii wide
        $cls2 = "WebSocketServerCompressionHandler" ascii wide
        $cls3 = "validExtensions" ascii wide
        $pkg1 = "io.netty:netty-codec-http" ascii wide
        $ext1 = "permessage-deflate" ascii wide

    condition:
        uint32(0) == 0xCAFEBABE or
        (any of ($cls1, $cls2, $pkg1) and any of ($cls3, $ext1))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100658 Netty WebSocket validExtensions Queue Exhaustion Attempt (HTTP/1.1 pipelining burst)"; flow:established,to_server; http.method; content:"GET"; http.protocol; content:"HTTP/1.1"; threshold:type both, track by_src, count 200, seconds 10; classtype:attempted-dos; reference:cve,2026-100658; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-100658; metadata:created_at 2026_01_01, updated_at 2026_01_01; sid:2026100658; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=10s
  [ network where network.transport == "tcp" and http.request.method == "GET" ] with runs=200

Splunk SPL Query

index=web sourcetype=access_combined
| bucket _time span=10s
| stats count as req_count dc(uri_path) as unique_paths by src_ip, _time
| where req_count > 200
| eval severity="medium", cve="CVE-2026-100658"
| table _time, src_ip, req_count, unique_paths, severity, cve

Wazuh OSSEC Rule

<group name="web,netty,cve-2026-100658,">
  <rule id="100658" level="10" frequency="200" timeframe="10">
    <if_matched_sid>31101</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-100658: High-rate pipelined HTTP requests against Netty service may exhaust validExtensions queue (WebSocketServerExtensionHandler)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations.

   • Disable the WebSocket permessage-deflate extension (i.e., stop wiring the WebSocketServerCompressionHandler / avoid enabling compression) if it is not operationally required. The NVD description states the exposure applies to servers enabling permessage-deflate.
   • Apply rate limiting and concurrent-connection caps at the edge (reverse proxy, load balancer, WAF) on all plain HTTP listeners, prioritizing controls that bound per-connection inbound request rates to blunt HTTP/1.1 pipelining bursts.
   • Disable or normalize HTTP/1.1 pipelining at the edge proxy where possible to reduce the inbound request rate imbalance.
   • Monitor JVM heap utilization and OutOfMemoryError events as a possible indicator of attempted exhaustion.

2. Patch / upgrade steps.

   • The NVD description identifies fixes in Netty 4.1.138.Final and 4.2.18.Final. Upgrade io.netty:netty-codec-http (and the wider Netty dependency set) to those versions or later.
   • Inventory all service dependencies that package Netty indirectly (frameworks bundling netty-codec-http) so transitive copies in the 4.1.88.Final–4.1.137.Final and 4.2.0.Final–4.2.17.Final ranges are also updated.
   • Note: patch confidence is 0/4 because no patch evidence has been collected from tracked sources; verify version status directly against the vendor before treating an environment as fixed.

3. Long-term hardening.

   • Enforce bounded internal queues and backpressure in custom pipeline handlers; never allow a per-channel queue to grow without an explicit cap.
   • Adopt defense-in-depth: terminate untrusted HTTP traffic only behind proxies with request-rate and connection limits, and keep JVM heap limits and restart policies in place.
   • Track Netty security advisories and maintain a software bill of materials (SBOM) so transitive netty-codec-http versions can be rapidly identified during the next Netty advisory.

References

• NVD — CVE-2026-100658: https://nvd.nist.gov/vuln/detail/CVE-2026-100658
• Netty project security advisories: https://netty.io/news/
• CWE-770 — Allocation of Resources Without Limits or Throttling: https://cwe.mitre.org/data/definitions/770.html
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-100658 not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Known threat actor campaigns / exploit-in-the-wild evidence: none identified in the provided data. No public PoC, no Nuclei template, no exploit code, and the CVE is not listed in CISA KEV.