{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/netty-codec-stomp--4.1.137.final-4.2.0.final---4.2.17.final/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-100657"}],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["netty-codec-stomp (\u003c= 4.1.137.Final, 4.2.0.Final - 4.2.17.Final)"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"threat","_cs_vendors":[],"content_html":"\u003cp\u003eA memory leak vulnerability, identified as CVE-2026-100657, exists within the \u003ccode\u003eio.netty:netty-codec-stomp\u003c/code\u003e component of the Netty framework. The vulnerability resides in the \u003ccode\u003eStompSubframeDecoder\u003c/code\u003e class, which improperly manages \u003ccode\u003eByteBuf\u003c/code\u003e allocations when processing frames. Specifically, upon reading a frame's content-length, the decoder allocates a chunk buffer and stores it in an instance field while awaiting a mandatory terminating NUL byte.\u003c/p\u003e\n\u003cp\u003eIf the terminating NUL byte is never received, the decoder fails to release the allocated buffer. This occurs because the \u003ccode\u003eskipNullCharacter\u003c/code\u003e method throws a \u003ccode\u003eSignal\u003c/code\u003e that extends \u003ccode\u003eError\u003c/code\u003e rather than \u003ccode\u003eException\u003c/code\u003e, bypassing the existing \u003ccode\u003ecatch(Exception)\u003c/code\u003e cleanup logic. Furthermore, the decoder lacks overrides for \u003ccode\u003ehandlerRemoved0\u003c/code\u003e or \u003ccode\u003echannelInactive\u003c/code\u003e, ensuring the memory persists even after the connection is closed. By repeatedly sending incomplete frames, an attacker can leak memory from the pooled allocator, leading to process memory exhaustion and denial-of-service. The issue affects Netty versions up to 4.1.137.Final and 4.2.0.Final through 4.2.17.Final.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in a persistent denial-of-service condition due to application-level memory exhaustion. Because the memory is pooled and not returned to the allocator or reclaimed by garbage collection, the impact is cumulative over the lifetime of the process, effectively terminating services that rely on the affected STOMP codec.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the identification and patching of systems utilizing the affected Netty codec versions.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all instances of \u003ccode\u003enetty-codec-stomp\u003c/code\u003e to version 4.1.138.Final or 4.2.18.Final to resolve the \u003ccode\u003eByteBuf\u003c/code\u003e management logic.\u003c/li\u003e\n\u003cli\u003eAudit application dependencies to identify vulnerable library versions listed in CVE-2026-100657.\u003c/li\u003e\n\u003cli\u003eMonitor application memory usage patterns and \u003ccode\u003eOutOfMemoryError\u003c/code\u003e events, as sustained spikes in heap consumption may indicate active exploitation of this memory leak.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-26T19:00:15Z","date_published":"2026-09-26T19:00:15Z","id":"https://feed.craftedsignal.io/briefs/2026-09-netty-stomp-leak/","summary":"An unauthenticated remote attacker can cause cumulative memory exhaustion and service denial by sending incomplete STOMP frames that trigger a buffer leak in Netty's StompSubframeDecoder.","title":"Denial of Service via ByteBuf Memory Leak in Netty STOMP Codec","url":"https://feed.craftedsignal.io/briefs/2026-09-netty-stomp-leak/"}],"language":"en","title":"CraftedSignal Threat Feed - Netty-Codec-Stomp (\u003c= 4.1.137.Final, 4.2.0.Final - 4.2.17.Final)","version":"https://jsonfeed.org/version/1.1"}