CVE-2026-93560

Summary

A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-length header exceeding the maximum integer value. This integer truncation vulnerability could lead to an infinite decode loop, causing a Denial of Service (DoS) by exhausting memory and CPU resources.

Affected Software

Weaknesses

• CWE-1035: CWE-1035

Workarounds

See https://github.com/netty/netty/security/advisories/GHSA-hmf3-49g9-g7qq for fixed versions and remediation guidance.

References

• https://access.redhat.com/security/cve/CVE-2026-93560
• https://bugzilla.redhat.com/show_bug.cgi?id=2536939

• ←Previous
• Next→