{"action":"Upgrade org.asynchttpclient:async-http-client to 3.0.14 or later.","affected":[{"fixed":"3.0.14","introduced":"3.0.0"},{"introduced":"2.2.0","last_affected":"2.16.1"}],"component":"org.asynchttpclient:async-http-client","cve_ids":["CVE-2026-107227"],"ecosystem":"Maven","epss":0.00426,"exploited":false,"fixed_versions":["3.0.14"],"ghsa_id":"GHSA-x8v2-478q-2hvg","id":"tcs_01M5N9J0HY2PX0C640SN16H0HV","modified_at":"2026-10-08T17:00:11.871230703Z","published_at":"2026-10-08T16:49:53Z","references":["https://osv.dev/vulnerability/GHSA-x8v2-478q-2hvg","https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-x8v2-478q-2hvg","https://nvd.nist.gov/vuln/detail/CVE-2026-107227","https://github.com/AsyncHttpClient/async-http-client/commit/b61637f30327f314b7693418f12ce141ac6b2b30","https://github.com/AsyncHttpClient/async-http-client","https://github.com/AsyncHttpClient/async-http-client/releases/tag/async-http-client-project-3.0.14"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-x8v2-478q-2hvg","url":"https://osv.dev/vulnerability/GHSA-x8v2-478q-2hvg"}],"summary":"AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled"}