Skip to content
Threat Feed
Subscribe

Tag

Application-Layer

2 briefs RSS
medium advisory

Netty StompSubframeDecoder Denial of Service Vulnerability (CVE-2026-44891)

A high-severity denial of service vulnerability, identified as CVE-2026-44891, exists in the `StompSubframeDecoder` component of Netty's `netty-codec-stomp` library, allowing an unauthenticated attacker to exhaust server memory and cause an `OutOfMemoryError` by sending a STOMP message with an excessive number of headers, leading to application crashes.

netty-codec-stomp +1 denial-of-service vulnerability netty java application-layer
1t
high advisory

Craft CMS: DOM XSS via GitHub issue title in CraftSupport widget

An attacker with only a GitHub account can plant a malicious JavaScript payload in a GitHub issue title, leading to a DOM Cross-Site Scripting (XSS) vulnerability (CVE-2026-55790) that executes in a Craft CMS administrator's control panel session when they use the CraftSupport widget and retrieve the poisoned issue, allowing for arbitrary JavaScript execution and potential unauthorized actions.

Craft CMS 5.x +1 xss web-vulnerability craft-cms application-layer
1t 1c 1i