{"id":"ECHO-5640-40fe-97dc","upstream":["CVE-2026-100658","GHSA-7fpc-p5rc-xwr5"],"severity":[],"modified":"2026-11-05T12:11:55.186Z","affected":[{"package":{"ecosystem":"Echo:Maven","name":"io.netty:netty-codec-http","purl":"pkg:maven/io.netty/netty-codec-http"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.74.Final+echo.6"}]}]}],"references":[{"type":"WEB","url":"https://advisory.echohq.com/cve/CVE-2026-100658"},{"type":"WEB","url":"https://github.com/netty/netty/security/advisories/GHSA-2g37-3h88-55hc"},{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100658"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/netty-before-4.1.138-final-denial-of-service-via-websocketserverextensionhandler"},{"type":"WEB","url":"https://github.com/advisories/GHSA-7fpc-p5rc-xwr5"}],"withdrawn":"2026-11-05T12:11:55.186Z","summary":"GHSA-2g37-3h88-55hc: WebSocketServerExtensionHandler's per-connection queue of negotiated\nextensions grows without bound with pipelined requests. Upstream's fix\n(https://github.com/netty/netty/commit/3574f7ed7a, 4.1.138.Final) caps that queue, which was\nintroduced in 4.1.88.Final (https://github.com/netty/netty/commit/f761ab5620, #13180).\n4.1.74.Final has no queue there: the handler keeps a single List<WebSocketServerExtension>\nfield that each new upgrade request overwrites, so it cannot grow per request.\n"}