The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.2.0 until 3.0.14, WebSocket permessage-deflate decompression is unbounded when compression is enabled. The inbound pipeline aggregates compressed frames before WebSocketClientCompressionHandler inflates them, so webSocketMaxFrameSize and webSocketMaxBufferSize do not bound decompressed output. A malicious WebSocket peer can send a small compressed message that expands to a very large Netty buffer and exhausts JVM heap. This issue is fixed in version 3.0.14.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and
    asynchronously process HTTP responses. From 2.2.0 until 3.0.14, WebSocket permessage-deflate decompression
    is unbounded when compression is enabled. The inbound pipeline aggregates compressed frames before
    WebSocketClientCompressionHandler inflates them, so webSocketMaxFrameSize and webSocketMaxBufferSize do
    not bound decompressed output. A malicious WebSocket peer can send a small compressed message that expands
    to a very large Netty buffer and exhausts JVM heap. This issue is fixed in version 3.0.14.
    (CVE-2026-107227)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and     asynchronously process HTTP responses. From 2.2.0 until 3.0.14, WebSocket permessage-deflate decompression     is unbounded when compression is enabled. The inbound pipeline aggregates compressed frames before     WebSocketClientCompressionHandler inflates them, so webSocketMaxFrameSize and webSocketMaxBufferSize do     not bound decompressed output. A malicious WebSocket peer can send a small compressed message that expands     to a very large Netty buffer and exhausts JVM heap. This issue is fixed in version 3.0.14.
    (CVE-2026-107227)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
474151	Chainguard: multiple druid packages: security update to 38.0.0-r4	Tenable Cloud Security	Chainguard Local Security Checks	Local	high
474151	Chainguard: multiple druid packages: security update to 38.0.0-r4	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	high
473870	SCA: security update for org.asynchttpclient:async-http-client (GHSA-x8v2-478q-2hvg)	Tenable Cloud Security	SCA Checks	Local	high
473870	SCA: security update for org.asynchttpclient:async-http-client (GHSA-x8v2-478q-2hvg)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
364234	Linux Distros Unpatched Vulnerability : CVE-2026-107227	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-107227

high

Tenable Plugins

high

high

high

high

high