WebSocket08FrameDecoder in Netty 3.6.x before 3.6.9 3.7.x before 3.7.1 3.8.x before 3.8.2 3.9.x before 3.9.1 and 4.0.x before 4.0.19 allows remote attackers to cause a denial of service (memory consumption) via a TextWebSocketFrame followed by a long stream of ContinuationWebSocketFrames.