Vulnerability · Published Oct 7, 2026 · Assigned by GitHub_M

CVE-2026-107227AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled

High 7.5

In plain English

A high-severity uncontrolled resource consumption in async-http-client from AsyncHttpClient. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.4%top 62.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.2.0 until 3.0.14, WebSocket permessage-deflate decompression is unbounded when compression is enabled. The inbound pipeline aggregates compressed frames before WebSocketClientCompressionHandler inflates them, so webSocketMaxFrameSize and webSocketMaxBufferSize do not bound decompressed output. A malicious WebSocket peer can send a small compressed message that expands to a very large Netty buffer and exhausts JVM heap. This issue is fixed in version 3.0.14.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	async-http-client	no fix listed	DEBIAN-CVE-2026-107227
Maven	org.asynchttpclient:async-http-client	3.0.14	GHSA-x8v2-478q-2hvg
Maven	org.asynchttpclient:async-http-client	no fix listed	GHSA-x8v2-478q-2hvg
Ubuntu:22.04:LTS	async-http-client	no fix listed	UBUNTU-CVE-2026-107227
Ubuntu:24.04:LTS	async-http-client	no fix listed	UBUNTU-CVE-2026-107227
Ubuntu:26.04:LTS	async-http-client	no fix listed	UBUNTU-CVE-2026-107227
Ubuntu:26.10	async-http-client	no fix listed	UBUNTU-CVE-2026-107227

Affected products (as reported)

Vendor	Product	Versions
AsyncHttpClient	async-http-client	>= 3.0.0, < 3.0.14>= 2.2.0, <= 2.16.1

Weakness: CWE-400, CWE-409 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-x8v2-478q-2hvg x_refsource_CONFIRM
https://github.com/AsyncHttpClient/async-http-client/commit/b61637f30327f314b7693418f12ce141ac6b2b30 x_refsource_MISC
https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.14 x_refsource_MISC