Description (CNA)
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.2.0 until 3.0.14, WebSocket permessage-deflate decompression is unbounded when compression is enabled. The inbound pipeline aggregates compressed frames before WebSocketClientCompressionHandler inflates them, so webSocketMaxFrameSize and webSocketMaxBufferSize do not bound decompressed output. A malicious WebSocket peer can send a small compressed message that expands to a very large Netty buffer and exhausts JVM heap. This issue is fixed in version 3.0.14.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| AsyncHttpClient / async-http-client | affected >= 3.0.0, < 3.0.14; affected >= 2.2.0, <= 2.16.1 |
CWE
CWE-400, CWE-409
References
- https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-x8v2-478q-2hvg
- https://github.com/AsyncHttpClient/async-http-client/commit/b61637f30327f314b7693418f12ce141ac6b2b30
- https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.14
ADP enrichment
No English description supplied.
No references supplied.