---
id: CVE-2026-44891
title: >-
  io.netty/netty-codec-stomp: Netty: Denial of Service vulnerability in STOMP
  decoder (CVE-2026-44891)
summary: >-
  A flaw was found in Netty, a network application framework, specifically
  within the StompSubframeDecoder component. This vulnerability allows a remote
  attacker to cause a denial of service (DoS) by sending a large number of small
  headers. …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-770
  - CWE-400
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7
affected:
  - jboss_enterprise_application_platform 7
  - single_sign_on 7
  - data_grid 8.6.3
  - build_of_apache_camel_4_18_3_for_spring_boot 3.5.16
patched:
  - data_grid 8.6.3
  - build_of_apache_camel_4_18_3_for_spring_boot 3.5.16
published: '2026-07-17'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T16:19:03+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44891.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44891.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-44891'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2501958'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-44891'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-44891'
  - url: >-
      https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b
  - url: >-
      https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6
  - url: 'https://github.com/netty/netty/pull/17063'
  - url: 'https://github.com/netty/netty/pull/17065'
  - url: 'https://github.com/netty/netty/releases/tag/netty-4.1.136.Final'
  - url: 'https://github.com/netty/netty/releases/tag/netty-4.2.16.Final'
  - url: 'https://github.com/netty/netty/security/advisories/GHSA-vhch-2wf3-m8rp'
  - url: 'https://access.redhat.com/errata/RHSA-2026:69296'
  - url: 'https://access.redhat.com/errata/RHSA-2026:54622'
  - url: 'https://github.com/advisories/GHSA-vhch-2wf3-m8rp'
tags:
  - csaf
  - vex
  - red-hat
  - ghsa
  - maven
epss: 0.00728
epssPercentile: 0.52214
aliases:
  - GHSA-vhch-2wf3-m8rp
ecosystem: maven
ingestedAt: '2026-07-14T20:39:11.227Z'
---

## Overview

A flaw was found in Netty, a network application framework, specifically within the StompSubframeDecoder component. This vulnerability allows a remote attacker to cause a denial of service (DoS) by sending a large number of small headers. The decoder fails to properly limit the total number or cumulative size of headers per frame, leading to excessive memory consumption and ultimately crashing the server.

## Vendor advisories

- **RHSA-2026:69296** · Red Hat · fixed in: Red Hat Data Grid 8.6.3 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69296)
- **RHSA-2026:54622** · Red Hat · fixed in: Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16 · released 2026-08-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:54622)
- **Red Hat VEX** · Important · affected: Red Hat JBoss Enterprise Application Platform 7, Red Hat Single Sign-On 7 · no fix planned: Red Hat JBoss Enterprise Application Platform 7, Red Hat Single Sign-On 7 · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44891.json)

**io.netty/netty-codec-stomp: Netty: Denial of Service vulnerability in STOMP decoder** — rated Important by Red Hat. Released 2026-07-17, updated 2026-09-21.

Affected:

- Red Hat JBoss Enterprise Application Platform 7
- Red Hat Single Sign-On 7

Fixed:

- Red Hat Data Grid 8.6.3
- Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16

No fix planned:

- Red Hat JBoss Enterprise Application Platform 7
- Red Hat Single Sign-On 7

Not affected:

- Red Hat JBoss Enterprise Application Platform Expansion Pack

## Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:69296
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:54622

Workarounds / mitigations:

- To reduce the risk of this denial of service, restrict network access to any services that expose a STOMP endpoint and use Netty's `StompSubframeDecoder`. Implement firewall rules or network access controls to permit connections only from trusted sources. This action limits the ability of untrusted remote clients to exploit the vulnerability.

## Package advisory (CVE-2026-44891)

Affected packages:

- `io.netty:netty-codec-stomp >= 4.2.0.Alpha1, <= 4.2.15.Final`
- `io.netty:netty-codec-stomp <= 4.1.135.Final`

Patched in:

- `io.netty:netty-codec-stomp 4.2.16.Final`
- `io.netty:netty-codec-stomp 4.1.136.Final`

Source: https://github.com/advisories/GHSA-vhch-2wf3-m8rp