CVE-2026-44891

Received Received - Intake

Denial of Service in Netty STOMP Subframe Decoder

Publication date: 2026-07-17

Last updated on: 2026-07-17

Assigner: GitHub, Inc.

Description

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, and the maxLineLength parameter only restricts individual header lines. An attacker can send a large number of short headers that are accumulated in memory inside DefaultStompHeadersSubframe until the JVM throws an OutOfMemoryError, causing denial of service for servers exposing a STOMP endpoint based on StompSubframeDecoder. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-17

Last Modified

2026-07-17

Generated

2026-07-18

AI Q&A

2026-07-18

EPSS Evaluated

N/A

NVD

CVE-2026-44891

Affected Vendors & Products

Vendor	Product	Version / Range
netty	netty	to 4.1.136.Final (exc)
netty	netty	to 4.2.16.Final (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability affects Netty, a network application framework. The issue is in the StompSubframeDecoder component which fails to limit the total number of headers or their cumulative size per frame. Attackers can exploit this by sending many short headers, causing memory exhaustion and a denial of service.

Detection Guidance

To detect this vulnerability, monitor for OutOfMemoryError exceptions in JVM logs of applications using Netty versions before 4.1.136.Final or 4.2.16.Final. Check for excessive memory usage in STOMP endpoint processes. No specific commands are provided in the context.

Impact Analysis

If you use a vulnerable version of Netty with a STOMP endpoint, an attacker could send specially crafted requests to crash your server by consuming all available memory. This would make your service unavailable until restarted.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that disrupt service availability. GDPR requires data protection measures, including availability, while HIPAA mandates secure and reliable access to health data. A DoS attack could violate these requirements by making systems unavailable.

Mitigation Strategies

Upgrade Netty to version 4.1.136.Final or 4.2.16.Final or later. If immediate upgrade is not possible, disable STOMP endpoints or implement network-level restrictions to limit malformed STOMP traffic.

Hi! I’m here to help you understand CVE-2026-44891. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70