The Netty STOMP codec converts the content‑length header to a 32‑bit integer. A remote attacker can craft a STOMP frame whose content‑length header exceeds the maximum integer value. The integer truncation causes the decoder to enter an infinite loop, repeatedly allocating memory and consuming CPU until the host is exhausted, which results in a denial of Service.

The vulnerability affects Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 7, Red Hat Single Sign‑On 7, and the Red Hat build of Apache Camel for Spring Boot 4. No specific patched versions are listed in the CNA data, but any deployment of the affected Netty STOMP codec components is susceptible.

The CVSS score of 7.5 indicates a high-impact denial of service. The EPSS score of 0.00409 (less than 1%) shows a very low probability of exploitation, and the issue is not listed in the CISA KEV catalog. The likely attack vector is a remote attacker who can send STOMP frames to the application without authentication. Once exploited, the infinite decode loop will consume server resources, potentially disrupting all other services.