Unbounded Decompression Vulnerability in AsyncHttpClient Library
CVE-2026-107227
What is CVE-2026-107227?
The AsyncHttpClient library, widely used for executing HTTP requests in Java applications, contains a vulnerability related to unbounded decompression of WebSocket messages. When compression is enabled, the library does not adequately limit decompressed outputs, allowing a malicious WebSocket peer to exploit this weakness. By sending a minimally sized compressed message that expands significantly when decompressed, attackers can cause a large buffer allocation, potentially exhausting the Java Virtual Machine (JVM) heap. This issue, present in versions prior to 3.0.14, has been addressed to safeguard applications using AsyncHttpClient.
Affected Version(s)
async-http-client >= 3.0.0, < 3.0.14 < 3.0.0, 3.0.14
async-http-client >= 2.2.0, <= 2.16.1 <= 2.2.0, 2.16.1