CVE-2026-44891High· 7.5▾ TwilightA flaw was found in Netty, a network application framework, specifically within the StompSubframeDecoder component. This vulnerability allows a remote attacker to cause a denial of service (DoS) by sending a large number of small headers. …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 18.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.7%
Last analysed / modified upstream
0.7% → 0.7%
A flaw was found in Netty, a network application framework, specifically within the StompSubframeDecoder component. This vulnerability allows a remote attacker to cause a denial of service (DoS) by sending a large number of small headers. The decoder fails to properly limit the total number or cumulative size of headers per frame, leading to excessive memory consumption and ultimately crashing the server.
io.netty/netty-codec-stomp: Netty: Denial of Service vulnerability in STOMP decoder — rated Important by Red Hat. Released 2026-07-17, updated 2026-09-21.
Affected:
Fixed:
No fix planned:
Not affected:
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:69296 Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:54622
Workarounds / mitigations:
StompSubframeDecoder. Implement firewall rules or network access controls to permit connections only from trusted sources. This action limits the ability of untrusted remote clients to exploit the vulnerability.Affected packages:
io.netty:netty-codec-stomp >= 4.2.0.Alpha1, <= 4.2.15.Finalio.netty:netty-codec-stomp <= 4.1.135.FinalPatched in:
io.netty:netty-codec-stomp 4.2.16.Finalio.netty:netty-codec-stomp 4.1.136.FinalConnected by shared product, vendor, weakness, or advisory.
CVE-2026-56817High· 7.5io.netty/netty-codec-xml: Netty: Information disclosure via XML External Entity (XXE) vulnerability (CVE-2026-56817)
CVE-2026-59649High· 7.5In Bouncy Castle for Java before 1.85, OpenPGP user-attribute subpacket length bounded only by JVM max memory
CVE-2026-14257High· 7.5brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)
CVE-2026-12151High· 7.5undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
CVE-2026-96541High· 7.5A denial-of-service flaw was found in gnome-remote-desktop
CVE-2026-6669Medium· 5.9Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25.2 allows a malicious or compromised PostgreSQL backend to cause uncontrolled CPU consumption in …