CVE-2026-100657

[CVE catalog]

Severity

High · CVSS 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Published

Sep 9, 2026, 10:00:00 PM UTC

Updated

Sep 26, 2026, 2:16:48 PM UTC

Source

[NVD] · [CVE record]

A flaw was found in the Netty STOMP codec. A remote attacker can trigger a memory leak by sending a complete frame body while withholding the terminating null byte, which prevents the allocated buffer from being released even after the connection is closed. Over time, repeated connections can cause continuous memory consumption, ultimately leading to a Denial of Service (DoS) due to memory exhaustion. io.netty/netty-codec-stomp: netty-codec-stomp: Denial of Service via memory leak during frame decoding A flaw in the Netty STOMP codec (netty-codec-stomp), rated Important by Red Hat, affects Red Hat products that ship and use this component, including Red Hat Single Sign-On 7 and the Red Hat build of Apache Camel 4. A remote, unauthenticated attacker can connect to a service that uses the Netty STOMP codec and send a complete, well-formed STOMP frame body while withholding the single NUL byte that terminates the frame. The decoder allocates a buffer for the frame content but never releases it: the replay signal used while waiting for the terminator is not caught by the decoder's exception cleanup path, and the decoder has no release path at channel teardown. With the default pooled allocator the leaked memory is neither returned to the pool nor reclaimed by garbage collection, even after the connection is closed, so an attacker can repeat the pattern to consume memory monotonically until the service fails from memory exhaustion. The issue is reachable before any application-level authentication, because a STOMP frame can be sent immediately on connect. Within Red Hat's product set, only applications that actually process STOMP frames with this codec are exposed. Red Hat JBoss Fuse 7 ships the component but is not affected because the vulnerable code is not in the execute path. For the affected products where the component is used, a fix is being pursued through the respective product streams; for Red Hat JBoss Enterprise Application Platform 7.4, which ships the affected component, a fix is not currently planned. Red Hat and upstream CVSS v3 scores are identical (7.5, Important); upstream additionally publishes a CVSS v4 score of 8.7. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.