Denial of Service Vulnerability in Netty StompSubframeDecoder

A memory leak vulnerability (CVE-2026-93494) exists within the StompSubframeDecoder component of the Netty framework. The flaw is triggered when an attacker sends a STOMP frame body that lacks the expected terminating null byte. Upon receiving such a frame, the decoder performs a ByteBuf allocation that is never subsequently released by the application logic. Because the allocation persists in memory, repeated submission of these crafted frames leads to cumulative, uncontrolled memory consumption. This resource exhaustion eventually causes the host application to crash or become unresponsive, effectively resulting in a Denial of Service (DoS) for any services utilizing the affected STOMP codec. Defenders should prioritize identifying applications leveraging Netty for STOMP protocol handling to evaluate exposure and schedule patches.

Impact

The vulnerability results in a Denial of Service for applications relying on the Netty StompSubframeDecoder. Persistent memory exhaustion can impact availability for any service exposed to untrusted STOMP traffic, potentially forcing service restarts or leading to total system instability if the memory limit is reached.

Recommendation

• Identify all internal and customer-facing applications that utilize the Netty framework, specifically those incorporating the StompSubframeDecoder component.
• Review vendor release notes and security advisories for the Netty project to identify the specific patched version containing the fix for CVE-2026-93494.
• Apply the vendor-provided patch to all vulnerable Netty implementations.
• Monitor memory utilization metrics for services handling STOMP traffic to detect potential exploitation attempts causing memory pressure.