Netty’s WebSocketServerExtensionHandler maintains an unbounded per‑connection queue that is populated for each incoming HTTP request but only drained when the application sends an HTTP response. A remote, unauthenticated attacker can send HTTP/1.1 pipelined requests that outpace the application’s response generation, causing the queue to grow indefinitely and eventually exhausting the JVM’s heap, which terminates the application with an OutOfMemoryError. This leads to a denial of service impacting availability of the server.

The vulnerability affects the Netty library, specifically versions 4.1.88.Final through 4.1.137.Final and 4.2.0.Final through 4.2.17.Final. Any server that enables WebSocket per‑message‑deflate compression on a plain HTTP port before a WebSocket upgrade or application‑level authentication is exercised is exposed.

With a CVSS score of 6.9 the vulnerability is considered moderate but can have significant operational impact. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Attackers need only access to the exposed HTTP port and can exploit the flaw without authentication, making it highly accessible in typical deployments.