CVE-2026-100657
Received Received - Intake

Memory Leak in Netty STOMP Codec

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Netty's STOMP codec (io.netty:netty-codec-stomp) contains a ByteBuf leak in StompSubframeDecoder. Once a frame's declared content-length has been fully read, the decoder allocates a chunk buffer from the channel allocator and parks it in an instance field while waiting for the single NUL byte that terminates the frame. If that byte never arrives, the buffer is never released: the replay Signal thrown by skipNullCharacter extends Error rather than Exception, so the decoder's catch(Exception) release path does not run, and StompSubframeDecoder overrides neither handlerRemoved0 nor channelInactive, so the buffer also survives channel teardown. A remote peer can leak one allocator buffer per connection by sending a complete, well-formed frame body and withholding its terminating NUL byte; with the default pooled allocator the memory is never returned to the pool or reclaimed by garbage collection, so the leak accumulates for the lifetime of the process and can lead to memory exhaustion. This affects versions up to and including 4.1.137.Final and versions 4.2.0.Final through 4.2.17.Final; it is fixed in 4.1.138.Final and 4.2.18.Final.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100657
EUVD
EUVD-2026-87751

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
netty netty-codec-stomp From 4.2.0.Final (inc) to 4.2.17.Final (inc)
netty netty to 4.1.137.Final (inc)
netty netty From 4.2.0 (inc) to 4.2.17.Final (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-772 The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a ByteBuf memory leak in Netty's STOMP codec (io.netty:netty-codec-stomp). When a STOMP frame's content-length is fully read but the terminating NUL byte is missing, the decoder allocates a buffer that is never released. This happens because the error handling does not trigger cleanup, and the buffer persists even after channel teardown. An attacker can exploit this by sending malformed frames to leak memory over time, potentially causing memory exhaustion.

Detection Guidance

Detecting this vulnerability requires monitoring for memory leaks in applications using Netty's STOMP codec. Check for increasing memory usage in Java processes running Netty applications. Use tools like jcmd <pid> VM.native_memory to inspect native memory allocations. Monitor for connections that remain open without proper termination. Look for frames with missing NUL terminators in STOMP traffic logs.

Impact Analysis

This vulnerability can lead to memory exhaustion in applications using affected Netty versions. An attacker could send specially crafted STOMP frames to leak memory buffers, eventually causing the application to run out of memory. This may result in crashes, degraded performance, or denial of service for the affected system.

Mitigation Strategies

Upgrade Netty to version 4.1.138.Final or 4.2.18.Final or later. If upgrading is not immediately possible, restrict network access to STOMP endpoints using firewalls or network segmentation. Monitor memory usage closely and restart affected services if memory exhaustion is detected. Consider disabling STOMP codec if not in use.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100657. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart