High severity7.5NVD Advisory· Published Jul 17, 2026· Updated Jul 23, 2026
CVE-2026-44891
CVE-2026-44891
Description
Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, and the maxLineLength parameter only restricts individual header lines. An attacker can send a large number of short headers that are accumulated in memory inside DefaultStompHeadersSubframe until the JVM throws an OutOfMemoryError, causing denial of service for servers exposing a STOMP endpoint based on StompSubframeDecoder. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
io.netty:netty-codec-stompMaven | >= 4.2.0.Alpha1, < 4.2.16.Final | 4.2.16.Final |
io.netty:netty-codec-stompMaven | < 4.1.136.Final | 4.1.136.Final |
Affected products
35- osv-coords33 versionspkg:apk/chainguard/apache-hoppkg:apk/chainguard/apache-hop-fipspkg:apk/chainguard/celeborn-0.5pkg:apk/chainguard/celeborn-0.6pkg:apk/chainguard/gremlin-serverpkg:apk/chainguard/management-api-for-apache-cassandra-4.0pkg:apk/chainguard/management-api-for-apache-cassandra-4.1pkg:apk/chainguard/management-api-for-apache-cassandra-5.0pkg:apk/chainguard/pinotpkg:apk/chainguard/pinot-fipspkg:apk/chainguard/seata-serverpkg:apk/chainguard/tezpkg:apk/chainguard/thingsboard-tb-mqtt-transportpkg:apk/chainguard/thingsboard-tb-nodepkg:apk/chainguard/trino-plugin-delta-lakepkg:apk/chainguard/trino-plugin-hivepkg:apk/chainguard/trino-plugin-hudipkg:apk/chainguard/trino-plugin-icebergpkg:apk/chainguard/trino-plugin-lakehousepkg:apk/chainguard/trino-plugin-pinotpkg:apk/wolfi/celeborn-0.5pkg:apk/wolfi/celeborn-0.6pkg:apk/wolfi/management-api-for-apache-cassandra-5.0pkg:apk/wolfi/tezpkg:apk/wolfi/thingsboard-tb-mqtt-transportpkg:apk/wolfi/thingsboard-tb-nodepkg:apk/wolfi/trino-plugin-delta-lakepkg:apk/wolfi/trino-plugin-hivepkg:apk/wolfi/trino-plugin-hudipkg:apk/wolfi/trino-plugin-icebergpkg:apk/wolfi/trino-plugin-lakehousepkg:apk/wolfi/trino-plugin-pinotpkg:rpm/opensuse/netty&distro=openSUSE%20Tumbleweed
< 2.18.1-r5+ 32 more
- (no CPE)range: < 2.18.1-r5
- (no CPE)range: < 2.18.1-r4
- (no CPE)range: < 0.5.4-r29
- (no CPE)range: < 0.6.3-r10
- (no CPE)range: < 3.8.1-r2
- (no CPE)range: < 0.1.122-r3
- (no CPE)range: < 0.1.122-r3
- (no CPE)range: < 0.1.122-r2
- (no CPE)range: < 1.5.1-r2
- (no CPE)range: < 1.5.1-r2
- (no CPE)range: < 2.6.0-r20
- (no CPE)range: < 0.10.5-r20
- (no CPE)range: < 4.3.1.3-r4
- (no CPE)range: < 4.3.1.3-r4
- (no CPE)range: < 483-r0
- (no CPE)range: < 483-r0
- (no CPE)range: < 483-r0
- (no CPE)range: < 483-r0
- (no CPE)range: < 483-r0
- (no CPE)range: < 483-r0
- (no CPE)range: < 0.5.4-r29
- (no CPE)range: < 0.6.3-r10
- (no CPE)range: < 0.1.122-r2
- (no CPE)range: < 0.10.5-r20
- (no CPE)range: < 4.3.1.3-r4
- (no CPE)range: < 4.3.1.3-r4
- (no CPE)range: < 483-r0
- (no CPE)range: < 483-r0
- (no CPE)range: < 483-r0
- (no CPE)range: < 483-r0
- (no CPE)range: < 483-r0
- (no CPE)range: < 483-r0
- (no CPE)range: < 4.1.136-1.1
Patches
Vulnerability mechanics
References
8- github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003bnvdPatch
- github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6nvdPatch
- github.com/netty/netty/pull/17063nvdIssue TrackingPatch
- github.com/netty/netty/pull/17065nvdIssue TrackingPatch
- github.com/netty/netty/security/advisories/GHSA-vhch-2wf3-m8rpnvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-vhch-2wf3-m8rpghsaADVISORY
- github.com/netty/netty/releases/tag/netty-4.1.136.FinalnvdRelease Notes
- github.com/netty/netty/releases/tag/netty-4.2.16.FinalnvdRelease Notes
News mentions
0No linked articles in our index yet.