{"record":{"id":"57e38caf63585ab4","repo":"TooTallNate/Java-WebSocket","slug":"inflated-fragment-size-exceeds-limit-of-maxfragme","errorCode":null,"errorMessage":"Inflated fragment size exceeds limit of {maxFragmentSize} bytes","messagePattern":"Inflated fragment size exceeds limit of (.+?) bytes","errorType":"exception","errorClass":"DataFormatException","httpStatus":null,"severity":"error","filePath":"src/main/java/org/java_websocket/extensions/permessage_deflate/PerMessageDeflateExtension.java","lineNumber":273,"sourceCode":"  }\n\n  private void decompress(ByteBuffer buffer, ByteArrayOutputStream decompressed)\n      throws DataFormatException {\n    if (buffer.hasArray()) {\n      decompressor.setInput(\n          buffer.array(), buffer.arrayOffset() + buffer.position(), buffer.remaining());\n    } else {\n      byte[] input = new byte[buffer.remaining()];\n      buffer.duplicate().get(input);\n      decompressor.setInput(input);\n    }\n    byte[] chunk = new byte[TRANSFER_CHUNK_SIZE];\n    while (!decompressor.finished()) {\n      int length = decompressor.inflate(chunk);\n      if (length > 0) {\n        decompressed.write(chunk, 0, length);\n        if (maxFragmentSize > 0 && maxFragmentSize < decompressed.size()) {\n          throw new DataFormatException(\n              \"Inflated fragment size exceeds limit of \" + maxFragmentSize + \" bytes\");\n        }\n      } else {\n        break;\n      }\n    }\n  }\n\n  @Override\n  public void encodeFrame(Framedata inputFrame) {\n    // RFC 7692: PMCEs operate only on data messages.\n    if (!(inputFrame instanceof DataFrame)) {\n      return;\n    }\n\n    // compression is only applicable if it was started on the first fragment\n    if (!isCompressing && inputFrame instanceof ContinuousFrame) {\n      return;","sourceCodeStart":255,"sourceCodeEnd":291,"githubUrl":"https://github.com/TooTallNate/Java-WebSocket/blob/afeacbf8c0f6f6a761c9d9daed8c813dd3b8ed7d/src/main/java/org/java_websocket/extensions/permessage_deflate/PerMessageDeflateExtension.java#L255-L291","documentation":"PerMessageDeflateExtension.decompress enforces maxFragmentSize on the INFLATED size of a fragment. If the decompressed output exceeds the configured limit (only when maxFragmentSize > 0), it throws DataFormatException('Inflated fragment size exceeds limit of N bytes'), which is then wrapped into InvalidDataException(1008) by the caller. This protects against decompression bombs.","triggerScenarios":"A compressed frame inflates to more than maxFragmentSize bytes while decompress() loops over decompressor.inflate(). Triggered by receiving a small malicious or legitimately huge compressed payload when a fragment size limit has been set via the extension configuration.","commonSituations":"Defense-against-zip-bomb limits configured too low for legitimate large messages; attackers sending highly compressible payloads to exhaust memory; default or copied configuration not tuned to the application's real message sizes.","solutions":["Raise maxFragmentSize when constructing PerMessageDeflateExtension to a value that fits your largest legitimate message after inflation.","If you don't want a limit, set maxFragmentSize to 0 (disables the check) — but only for trusted peers.","Keep the limit for untrusted clients and instead paginate large messages into multiple frames on the sender side.","Log the configured limit versus actual inflated size to tune the threshold."],"exampleFix":"// before\nPerMessageDeflateExtension ext = new PerMessageDeflateExtension();\next.setMaxFragmentSize(1024); // too small for real payloads\n\n// after\nPerMessageDeflateExtension ext = new PerMessageDeflateExtension();\next.setMaxFragmentSize(10 * 1024 * 1024); // 10 MB inflated limit","handlingStrategy":"validation","validationCode":"// size-check payload bounds before send on the sender side\nif (estimatedInflatedSize > maxFragmentSize) {\n    throw new IllegalArgumentException(\"message exceeds negotiated fragment size limit\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    byte[] data = decompressed(frame);\n} catch (InvalidDataException e) {\n    if (e.getMessage() != null && e.getMessage().contains(\"exceeds limit\")) {\n        logger.warn(\"decompression bomb attempt or limit too low\");\n    }\n    webSocket.close(1009, \"message too big\");\n}","preventionTips":["Tune maxFragmentSize to your largest legitimate inflated message","Keep a limit for untrusted peers to prevent decompression bombs","Segment very large messages into multiple frames"],"tags":["websocket","permessage-deflate","decompression-bomb","size-limit","security"],"backgroundTag":"file-size-limit-exceeded","analyzedSha":"afeacbf8c0f6f6a761c9d9daed8c813dd3b8ed7d","analyzedAt":"2026-09-09T14:39:47.546Z","contentChangedAt":"2026-09-09T14:39:47.546Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}