Denial of Service via ByteBuf Memory Leak in Netty STOMP Codec

A memory leak vulnerability, identified as CVE-2026-100657, exists within the io.netty:netty-codec-stomp component of the Netty framework. The vulnerability resides in the StompSubframeDecoder class, which improperly manages ByteBuf allocations when processing frames. Specifically, upon reading a frame's content-length, the decoder allocates a chunk buffer and stores it in an instance field while awaiting a mandatory terminating NUL byte.

If the terminating NUL byte is never received, the decoder fails to release the allocated buffer. This occurs because the skipNullCharacter method throws a Signal that extends Error rather than Exception, bypassing the existing catch(Exception) cleanup logic. Furthermore, the decoder lacks overrides for handlerRemoved0 or channelInactive, ensuring the memory persists even after the connection is closed. By repeatedly sending incomplete frames, an attacker can leak memory from the pooled allocator, leading to process memory exhaustion and denial-of-service. The issue affects Netty versions up to 4.1.137.Final and 4.2.0.Final through 4.2.17.Final.

Impact

Successful exploitation results in a persistent denial-of-service condition due to application-level memory exhaustion. Because the memory is pooled and not returned to the allocator or reclaimed by garbage collection, the impact is cumulative over the lifetime of the process, effectively terminating services that rely on the affected STOMP codec.

Recommendation

Prioritize the identification and patching of systems utilizing the affected Netty codec versions.

• Upgrade all instances of netty-codec-stomp to version 4.1.138.Final or 4.2.18.Final to resolve the ByteBuf management logic.
• Audit application dependencies to identify vulnerable library versions listed in CVE-2026-100657.
• Monitor application memory usage patterns and OutOfMemoryError events, as sustained spikes in heap consumption may indicate active exploitation of this memory leak.