redhat/netty-codec-stomp vulnerabilities

Latest redhat/netty-codec-stomp CVEs

Newest publication first

1. CVE-2026-93560 Io.netty/netty-codec-stomp: netty: stomp codec content-length long-to-int truncation causes infinite decode loop dos

   Published 2026-09-18

   High·CVSS 7.5 EPSS 0.41%

   A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-length header exceeding the maximum integer value. This integer truncation vulnerability could lead to an infinite decode loop, causing a Denial of Service (DoS)...

2. CVE-2026-93494 Io.netty/netty-codec-stomp: netty: bytebuf leak in stompsubframedecoder when a frame body is never terminated

   Published 2026-09-18

   High·CVSS 7.5 EPSS 0.41%

   A flaw was found in Netty's StompSubframeDecoder component. A remote attacker can exploit this vulnerability by sending a specially crafted STOMP frame body without its terminating null byte. This causes the decoder to allocate a ByteBuf (a buffer for bytes) that is never release...

3. CVE-2026-89044 Netty 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final HTTP Request Smuggling via Transfer-Encoding

   Published 2026-09-10

   Medium·CVSS 6.9 EPSS 0.28%

   Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-Encoding header, allowing attackers to smuggle requests by using malformed encoding declarations. Attackers can split Trans...

4. CVE-2026-59903 Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite

   Published 2026-08-17

   High·CVSS 7.5 EPSS 0.32%

   Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN...

5. CVE-2026-59920 Netty: STOMP CONNECT Frame Header Injection

   Published 2026-07-29

   Medium·CVSS 6.5 EPSS 0.42%

   Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's STOMP encoder ( StompSubframeEncoder ) does not escape or validate header values in CONNECT and CONNECTED frames, so raw newline ( \n ) characters in...

6. CVE-2026-44891 Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder

   Published 2026-07-17

   High·CVSS 7.5 EPSS 0.73%

   Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, and the maxLineLengt...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.