The Netty STOMP codec converts the content‑length header to a 32‑bit integer. A remote attacker can craft a STOMP frame whose content‑length header exceeds the maximum integer value. The integer truncation causes the decoder to enter an infinite loop, repeatedly allocating memory and consuming CPU until the host is exhausted, which results in a denial of Service.

The vulnerability affects Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 7, Red Hat Single Sign‑On 7, and the Red Hat build of Apache Camel for Spring Boot 4. No specific patched versions are listed in the CNA data, but any deployment of the affected Netty STOMP codec components is susceptible.

The CVSS score of 7.5 indicates a high impact denial of service. EPSS is not available, and the issue is not listed in the CISA KEV catalog. The likely attack vector is a remote attacker who can send STOMP frames to the application; authentication is not required. Once exploited, the infinite decode loop will consume server resources, potentially disrupting all other services.