EUVD-2026-82745
GHSA-xvr4-c5q3-q5wm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated remote attacker sends a simple malformed STOMP frame (AV:N/AC:L/PR:N/UI:N); cumulative unreleased buffers cause full DoS (A:H) with no confidentiality or integrity impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
5DescriptionCVE.org
A flaw was found in Netty's StompSubframeDecoder component. A remote attacker can exploit this vulnerability by sending a specially crafted STOMP frame body without its terminating null byte. This causes the decoder to allocate a ByteBuf (a buffer for bytes) that is never released, leading to a permanent memory leak. Over time, this uncontrolled memory consumption can result in a Denial of Service (DoS) for the application using the affected STOMP codec.
AnalysisAI
Unauthenticated remote attackers can cause a gradual denial of service in applications that use Netty's STOMP codec by sending a STOMP frame body without the terminating null byte; StompSubframeDecoder leaks a ByteBuf for each such frame, so sustained traffic exhausts JVM heap or direct memory. The issue carries CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning network-reachable, no authentication or user interaction, availability-only impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application uses Netty's STOMP codec - specifically the StompSubframeDecoder - on a network endpoint the attacker can reach; the trigger is a STOMP frame whose body is sent without its terminating null byte. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a network-reachable, unauthenticated, availability-only denial of service - no confidentiality or integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Exact fixed versions are not provided in the supplied data, so patch status should be confirmed via Red Hat's CVE page (https://access.redhat.com/security/cve/CVE-2026-93494) and Bugzilla 2536898; apply vendor errata for the affected Red Hat product or upgrade the Netty dependency as soon as a patched release is published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all affected Red Hat middleware instances with STOMP-over-TCP/WebSocket enabled, confirm applicability of CVE-2026-93494, restrict network access via firewall or security group rules to trusted sources only, and enable alerting on JVM heap and direct memory growth. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Fuse 7
View allHTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Mismatched handling of the HTTP/1 absolute-form request authority in Red Hat build of Quarkus and other affected Red Hat
Jolokia's JSR-160 proxy in multiple Red Hat middleware products allows network-accessible unauthenticated attackers (per
Denial-of-service in Undertow's WebSocket permessage-deflate implementation allows unauthenticated remote attackers to e
Remote code execution in Red Hat Apache Camel Infinispan component allows low-privileged attackers to execute arbitrary
Undertow's WebSocket subsystem fails to enforce configurable upper bounds on message buffer sizes and session timeouts,
Unauthenticated remote file read in RESTEasy's SourceProvider component allows network attackers to exfiltrate arbitrary
Improper handling of HTTP/2 and HTTP/3 Extended CONNECT requests in Netty-based services can downgrade them to ordinary
SMTP command injection in Netty's netty-codec-smtp allows unauthenticated remote attackers to inject arbitrary SMTP comm
Malformed HTTP/2 CONNECT stream injection in Red Hat JBoss EAP and the wider Red Hat middleware stack (Quarkus, Keycloak
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today