Description
Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, and the maxLineLength parameter only restricts individual header lines. An attacker can send a large number of short headers that are accumulated in memory inside DefaultStompHeadersSubframe until the JVM throws an OutOfMemoryError, causing denial of service for servers exposing a STOMP endpoint based on StompSubframeDecoder. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Published: 2026-07-17
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw in Netty's StompSubframeDecoder permits an attacker to send an unlimited number or total size of STOMP header lines. The decoder only limits the length of each line, not the count or cumulative size, causing memory to grow as each header is stored in a DefaultStompHeadersSubframe instance. When the accumulated headers exceed the JVM's available memory, an OutOfMemoryError is thrown, crashing or restarting the server. This results in a denial of service and is related to CWE‑400 and CWE‑770.

Affected Systems

Applications built with Netty versions earlier than 4.1.136.Final or 4.2.16.Final that expose a STOMP endpoint using StompSubframeDecoder are impacted.

Risk and Exploitability

The CVSS score of 7.5 indicates high severity. The EPSS value of less than 1% shows a low but non‑zero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. A remote attacker that can reach the STOMP endpoint over the network can craft large numbers of short headers to trigger the bug, causing the server to run out of memory.

Generated by OpenCVE AI on July 30, 2026 at 23:31 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Netty to the fixed release 4.1.136.Final or newer (including 4.2.16.Final).
  • If an upgrade cannot be applied immediately, enforce custom limits on header count or cumulative header size in your STOMP configuration or disable the endpoint during maintenance.
  • Implement runtime monitoring to detect OutOfMemoryError events and configure the JVM or orchestrator to restart the affected service automatically.

Generated by OpenCVE AI on July 30, 2026 at 23:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-vhch-2wf3-m8rp Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder
History

Tue, 28 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Mon, 20 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 17 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Netty
Netty netty
Vendors & Products Netty
Netty netty

Fri, 17 Jul 2026 20:45:00 +0000

Type Values Removed Values Added
Description Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, and the maxLineLength parameter only restricts individual header lines. An attacker can send a large number of short headers that are accumulated in memory inside DefaultStompHeadersSubframe until the JVM throws an OutOfMemoryError, causing denial of service for servers exposing a STOMP endpoint based on StompSubframeDecoder. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Title Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder
Weaknesses CWE-400
CWE-770
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Netty Netty
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-20T14:00:09.257Z

Reserved: 2026-05-07T21:50:33.545Z

Link: CVE-2026-44891

cve-icon Vulnrichment

Updated: 2026-07-20T14:00:05.263Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Important

Publid Date: 2026-07-17T20:16:24Z

Links: CVE-2026-44891 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-30T23:45:05Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-770

    Allocation of Resources Without Limits or Throttling