CVE-2026-100658

🗓️ 26 Sep 2026 13:23:26Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 33 Views

Unauthenticated DoS in Netty netty-codec-http via unbounded queue in WebSocketServerExtensionHandler.

Reporter	Title	Published	Views	Family All 11
IBM Security Bulletins	Security Bulletin: IBM SPSS Analytic Server is affected by multiple vulnerabilities in Netty	9 Oct 202604:39	–	ibm
IBM Security Bulletins	Security Bulletin:Multiple vulnerabilities in netty-codec-http may affect IBM Infosphere Change Data Capture (CVE-2026-100655, CVE-2026-100656, CVE-2026-100658, CVE-2026-93558, CVE-2026-93565, CVE-2026-93566, CVE-2026-93573)	26 Oct 202618:18	–	ibm
Cvelist	CVE-2026-100658	26 Sep 202613:23	–	cvelist
EUVD	EUVD-2026-87752	26 Sep 202613:23	–	euvd
NVD	CVE-2026-100658	26 Sep 202614:16	–	nvd
osv_cleanstart	CLEANSTART-2026-JW99671 Rejected reason: This CVE ID has been rejected as a duplicate	8 Oct 202600:42	–	osv_cleanstart
osv_cve	CVE-2026-100658 Netty before 4.1.138.Final Denial of Service via WebSocketServerExtensionHandler	26 Sep 202613:23	–	osv_cve
osv_echo	ECHO-5640-40FE-97DC GHSA-2g37-3h88-55hc: WebSocketServerExtensionHandler's per-connection queue of negotiated extensions grows without bound with pipelined requests. Upstream's fix (https://github.com/netty/netty/commit/3574f7ed7a, 4.1.138.Final) caps that queue, which was introduced in 4.1.88.Final (https://github.com/netty/netty/commit/f761ab5620, #13180). 4.1.74.Final has no queue there: the handler keeps a single List<WebSocketServerExtension> field that each new upgrade request overwrites, so it cannot grow per request.	1 Nov 202608:55	–	osv_echo
Positive Technologies	PT-2026-99329	26 Sep 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-100658: Undefined Security Weakness	26 Sep 202600:00	–	rapid7

28 Sep 2026 22:17Current

5.8Medium risk

Vulners AI Score5.8

EPSS0.00349

Netty netty-codec-http WebSocketServerExtensionHandler OutOfMemoryError HTTP/1.1 pipelining permessage-deflate