CVE-2026-100658 Netty before 4.1.138.Final Denial of Service via WebSocketServerExtensionHandler

Netty io.netty:netty-codec-http contains an unbounded per-connection queue in WebSocketServerExtensionHandler. The handler offers an entry to its per-channel validExtensions queue for every inbound HttpRequest, but polls an entry only when the application writes an HttpResponse, and the queue siz...