CVE-2026-93560: Netty STOMP Codec DoS Vulnerability

CVE-2026-93560 Overview

A flaw in the Netty STOMP codec allows a remote attacker to trigger a denial of service through integer truncation. The vulnerability occurs when a specially crafted Simple Text Oriented Messaging Protocol (STOMP) frame contains a content-length header exceeding the maximum integer value. Truncation of the header value leads to an infinite decode loop, exhausting CPU and memory resources on the target host. The issue is classified under [CWE-1035] and affects applications relying on the Netty STOMP codec for message parsing.

Critical Impact
An unauthenticated remote attacker can crash Netty-based services by sending a single malformed STOMP frame, disrupting availability of dependent applications.

Affected Products

Netty STOMP codec (io.netty:netty-codec-stomp)
Applications and middleware embedding the Netty STOMP codec
Red Hat products bundling the affected Netty component (see Red Hat CVE-2026-93560)

Discovery Timeline

2026-09-18 - CVE-2026-93560 published to the National Vulnerability Database
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-93560

Vulnerability Analysis

The Netty STOMP codec parses frame headers, including content-length, to determine how many payload bytes to read from the underlying buffer. When the codec processes a content-length value that exceeds Integer.MAX_VALUE, the numeric conversion truncates the value. The truncated result no longer reflects the attacker-supplied length, causing the decoder to enter a loop that never satisfies its exit condition. The loop continues to allocate and consume resources while attempting to decode subsequent bytes.

Because STOMP endpoints commonly accept unauthenticated connections during the initial handshake, the attack can be launched over the network without prior credentials or user interaction. A single malformed frame can render the receiving process unresponsive, forcing operators to restart the affected service.

Root Cause

The root cause is a numeric truncation error in the STOMP frame decoder. The codec treats the content-length header as a bounded integer without validating that the parsed value stays within safe processing limits. When truncation produces a value inconsistent with the actual frame data, the decode state machine cannot progress, resulting in an infinite loop and resource exhaustion.

Attack Vector

An unauthenticated remote attacker opens a TCP connection to a STOMP endpoint backed by Netty. The attacker sends a single STOMP frame with a content-length header set above Integer.MAX_VALUE. The Netty decoder truncates the header value and enters an infinite decode loop, consuming CPU and heap memory. Repeated frames from multiple connections amplify the impact and can bring down the service entirely.

Refer to the Red Hat Bugzilla report for additional technical context and vendor-specific fix status.

Detection Methods for CVE-2026-93560

Indicators of Compromise

Sustained high CPU utilization in Java Virtual Machine (JVM) processes hosting Netty STOMP endpoints.
Rapid heap growth or OutOfMemoryError events in application logs tied to STOMP frame processing.
Unresponsive STOMP listeners following inbound connections from unfamiliar source addresses.

Detection Strategies

Inspect network traffic for STOMP frames whose content-length header exceeds 2147483647.
Correlate JVM thread dumps showing threads blocked inside StompSubframeDecoder with concurrent inbound STOMP connections.
Enable application performance monitoring to alert on abnormal decode latency for STOMP channels.

Monitoring Recommendations

Log and retain STOMP handshake metadata including source IP, frame size, and header values for forensic review.
Alert on repeated TCP connections to STOMP ports followed by immediate service degradation.
Track dependency inventories to identify all services embedding vulnerable versions of netty-codec-stomp.

How to Mitigate CVE-2026-93560

Immediate Actions Required

Upgrade the Netty STOMP codec to the fixed release identified in the vendor advisory once available.
Restrict network access to STOMP endpoints so only trusted clients and brokers can connect.
Enforce upstream frame size limits at load balancers or reverse proxies to reject oversized headers before they reach the decoder.

Patch Information

Consult the Red Hat CVE-2026-93560 advisory for fixed package versions and errata specific to Red Hat products. Application owners using upstream Netty should track the project's release notes and update io.netty:netty-codec-stomp to the patched version. Rebuild and redeploy any fat JARs or container images that bundle the vulnerable codec.

Workarounds

Terminate STOMP traffic behind a proxy that validates header sizes and drops frames with malformed content-length values.
Apply firewall rules limiting STOMP listener exposure to authenticated internal networks only.
Configure connection rate limits and per-client resource caps to reduce the blast radius of a successful exploit attempt.

bash

# Example iptables rule limiting STOMP (default port 61613) exposure to trusted subnet
iptables -A INPUT -p tcp --dport 61613 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 61613 -j DROP