CVE-2026-107227: Asynchttpclient Async-HTTP-Client

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.2.0 until 3.0.14, WebSocket permessage-deflate decompression is unbounded when compression is enabled. The inbound pipeline aggregates compressed frames before WebSocketClientCompressionHandler inflates them, so webSocketMaxFrameSize and webSocketMaxBufferSize do not bound decompressed output. A malicious WebSocket peer can send a small compressed message that expands to a very large Netty buffer and exhausts JVM heap. This issue is fixed in version 3.0.14.

Affected products

• Asynchttpclient Async-HTTP-Client: from 3.0.0, before 3.0.14 (fixed in 3.0.14); from 2.2.0, up to and including 2.16.1

Published 2026-10-07. Last modified 2026-10-08.