CVE-2026-93494 Overview
CVE-2026-93494 is a memory leak vulnerability in the StompSubframeDecoder component of Netty, an asynchronous event-driven network application framework used widely in Java-based server implementations. A remote attacker can trigger the flaw by sending a malformed Simple Text Oriented Messaging Protocol (STOMP) frame body that omits its terminating null byte. The decoder allocates a ByteBuf buffer to process the frame but never releases it, producing a permanent memory leak. Repeated exploitation exhausts JVM heap memory and drives the affected application into a denial of service (DoS) condition. The weakness maps to [CWE-1035], a category covering vulnerable third-party components.
Critical Impact
Unauthenticated remote attackers can exhaust application memory over time, resulting in denial of service against any service using the Netty STOMP codec.
Affected Products
- Netty framework — StompSubframeDecoder component
- Java applications and services embedding the affected Netty STOMP codec
- Downstream distributions tracked in the Red Hat CVE-2026-93494 Advisory
Discovery Timeline
- 2026-09-18 - CVE-2026-93494 published to the National Vulnerability Database (NVD)
- 2026-09-25 - Last updated in NVD database
Technical Details for CVE-2026-93494
Vulnerability Analysis
The vulnerability resides in Netty's STOMP decoder logic that parses inbound frame bodies. STOMP frames are delimited by a trailing null byte (0x00) that signals the end of the body. When a frame body is delivered without this terminator, the decoder path allocates a ByteBuf for the pending data but does not reach the release path that would normally free the buffer once the frame completes.
Each malformed frame contributes a leaked buffer to the JVM heap. Because Netty relies on reference counting for ByteBuf lifecycle management, the missing release call prevents both pooled and unpooled buffers from returning to the allocator. Attackers can amplify the impact by sending large partial STOMP bodies, causing accelerated heap consumption and eventual OutOfMemoryError conditions.
Additional discussion is available in the Red Hat Bug 2536898 Discussion.
Root Cause
The root cause is improper resource lifecycle handling in the StompSubframeDecoder state machine. The decoder allocates a working buffer when a body chunk is received but fails to release that buffer when parsing terminates abnormally due to a missing null terminator. No bounded timeout or fallback release path exists for incomplete STOMP frames.
Attack Vector
Exploitation requires only network reachability to a listener that uses Netty's STOMP codec. No authentication or user interaction is needed. An attacker opens a TCP or WebSocket connection to the STOMP endpoint and transmits crafted frames whose body length is declared but whose terminating null byte is omitted. Repeating this pattern across one or many connections drives sustained heap growth until the service becomes unresponsive.
No verified proof-of-concept code is publicly available. Refer to the Red Hat advisory
and Bugzilla discussion for technical reproduction details.
Detection Methods for CVE-2026-93494
Indicators of Compromise
- Sustained JVM heap growth on services exposing STOMP endpoints without a corresponding increase in legitimate message throughput.
- Repeated OutOfMemoryError events or garbage collection thrash in application logs tied to Netty allocator classes.
- Elevated counts of partially received STOMP frames or protocol parse warnings from Netty pipeline handlers.
Detection Strategies
- Instrument the Netty allocator with ResourceLeakDetector at PARANOID level in non-production environments to surface unreleased ByteBuf allocations.
- Correlate application performance monitoring (APM) heap metrics with network telemetry for STOMP ports to identify slow-burn resource exhaustion patterns.
- Deploy network intrusion detection signatures that flag STOMP frames declaring a body but lacking the trailing 0x00 byte.
Monitoring Recommendations
- Alert on rapid connection churn or long-lived connections sending fragmented STOMP frames from a single source.
- Track per-tenant heap utilization for multi-tenant services using Netty STOMP to isolate abusive clients.
- Forward JVM garbage collection logs and Netty pipeline exceptions to centralized logging for retrospective analysis.
How to Mitigate CVE-2026-93494
Immediate Actions Required
- Inventory all services and libraries that embed Netty and use the StompSubframeDecoder codec.
- Restrict network exposure of STOMP endpoints to trusted clients using firewall rules or service mesh policies until patching completes.
- Configure JVM heap limits and container memory caps so a leaking process fails fast rather than degrading shared infrastructure.
Patch Information
Refer to the Red Hat CVE-2026-93494 Advisory for the list of fixed package versions in Red Hat distributions. Upstream fixes for Netty should be tracked through the Netty project's release notes. Upgrade to the first Netty release that includes the corrected StompSubframeDecoder buffer release logic and rebuild any application that shades or repackages Netty.
Workarounds
- Disable the STOMP codec in the Netty pipeline if the application does not require STOMP protocol support.
- Enforce a maximum frame size and idle timeout on inbound STOMP connections to bound the memory impact of malformed frames.
- Place a protocol-aware proxy in front of the STOMP endpoint to reject frames that lack the terminating null byte before they reach the vulnerable decoder.
# Example: restrict STOMP port exposure with iptables until patching completes
iptables -A INPUT -p tcp --dport 61613 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 61613 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.