{"id":"CVE-2026-44891","title":"io.netty/netty-codec-stomp: Netty: Denial of Service vulnerability in STOMP decoder (CVE-2026-44891)","summary":"A flaw was found in Netty, a network application framework, specifically within the StompSubframeDecoder component. This vulnerability allows a remote attacker to cause a denial of service (DoS) by sending a large number of small headers. …","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":["CWE-770","CWE-400"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","affected":["jboss_enterprise_application_platform 7","single_sign_on 7","data_grid 8.6.3","build_of_apache_camel_4_18_3_for_spring_boot 3.5.16"],"patched":["data_grid 8.6.3","build_of_apache_camel_4_18_3_for_spring_boot 3.5.16"],"published":"2026-07-17","updated":"2026-09-21","sourceUpdated":"2026-09-21T16:19:03+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44891.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44891.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-44891"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2501958"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44891"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44891"},{"url":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"},{"url":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"},{"url":"https://github.com/netty/netty/pull/17063"},{"url":"https://github.com/netty/netty/pull/17065"},{"url":"https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"},{"url":"https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"},{"url":"https://github.com/netty/netty/security/advisories/GHSA-vhch-2wf3-m8rp"},{"url":"https://access.redhat.com/errata/RHSA-2026:69296"},{"url":"https://access.redhat.com/errata/RHSA-2026:54622"},{"url":"https://github.com/advisories/GHSA-vhch-2wf3-m8rp"}],"tags":["csaf","vex","red-hat","ghsa","maven"],"epss":0.00728,"epssPercentile":0.52148,"aliases":["GHSA-vhch-2wf3-m8rp"],"ecosystem":"maven","ingestedAt":"2026-07-14T20:39:11.227Z","slug":"CVE-2026-44891","body":"## Overview\n\nA flaw was found in Netty, a network application framework, specifically within the StompSubframeDecoder component. This vulnerability allows a remote attacker to cause a denial of service (DoS) by sending a large number of small headers. The decoder fails to properly limit the total number or cumulative size of headers per frame, leading to excessive memory consumption and ultimately crashing the server.\n\n## Vendor advisories\n\n- **RHSA-2026:69296** · Red Hat · fixed in: Red Hat Data Grid 8.6.3 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69296)\n- **RHSA-2026:54622** · Red Hat · fixed in: Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16 · released 2026-08-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:54622)\n- **Red Hat VEX** · Important · affected: Red Hat JBoss Enterprise Application Platform 7, Red Hat Single Sign-On 7 · no fix planned: Red Hat JBoss Enterprise Application Platform 7, Red Hat Single Sign-On 7 · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44891.json)\n\n**io.netty/netty-codec-stomp: Netty: Denial of Service vulnerability in STOMP decoder** — rated Important by Red Hat. Released 2026-07-17, updated 2026-09-21.\n\nAffected:\n\n- Red Hat JBoss Enterprise Application Platform 7\n- Red Hat Single Sign-On 7\n\nFixed:\n\n- Red Hat Data Grid 8.6.3\n- Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16\n\nNo fix planned:\n\n- Red Hat JBoss Enterprise Application Platform 7\n- Red Hat Single Sign-On 7\n\nNot affected:\n\n- Red Hat JBoss Enterprise Application Platform Expansion Pack\n\n## Remediation\n\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:69296\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:54622\n\nWorkarounds / mitigations:\n\n- To reduce the risk of this denial of service, restrict network access to any services that expose a STOMP endpoint and use Netty's `StompSubframeDecoder`. Implement firewall rules or network access controls to permit connections only from trusted sources. This action limits the ability of untrusted remote clients to exploit the vulnerability.\n\n## Package advisory (CVE-2026-44891)\n\nAffected packages:\n\n- `io.netty:netty-codec-stomp >= 4.2.0.Alpha1, <= 4.2.15.Final`\n- `io.netty:netty-codec-stomp <= 4.1.135.Final`\n\nPatched in:\n\n- `io.netty:netty-codec-stomp 4.2.16.Final`\n- `io.netty:netty-codec-stomp 4.1.136.Final`\n\nSource: https://github.com/advisories/GHSA-vhch-2wf3-m8rp","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}