EUVD-2026-82924
GHSA-258j-9683-m467
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated network-reachable STOMP frame triggers an infinite decode loop (PR:N/UI:N/AC:L); pure availability impact with no data exposure (C:N/I:N/A:H).
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
3DescriptionCVE.org
STOMP codec content-length long-to-int truncation causes infinite decode loop DoS
AnalysisAI
Denial of service in Red Hat's Camel-based and Java middleware products (Red Hat Build of Apache Camel for Spring Boot 4, Red Hat Fuse 7, JBoss EAP 7, and Red Hat Single Sign-On 7): a STOMP frame that declares an oversized content-length is truncated from a 64-bit long to a 32-bit integer, yielding a wrapped/negative length that leaves the STOMP decoder unable to advance, so it loops indefinitely and burns CPU on the affected message-processing thread. The flaw is remotely reachable and unauthenticated per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), but exposure is strictly limited to deployments that actually enable a network-reachable STOMP listener - products without a configured STOMP endpoint are not attackable. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the affected application (Red Hat Fuse 7, Single Sign-On 7, JBoss EAP 7, or Build of Apache Camel for Spring Boot 4) to expose and process STOMP protocol frames through the vulnerable Netty-based STOMP codec; the attacker must be able to send a raw STOMP frame with a content-length value that overflows the long-to-int conversion. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a legitimate but bounded availability risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released fixed version is identified in the available data; Red Hat is tracking the issue under CVE-2026-93560 (https://access.redhat.com/security/cve/CVE-2026-93560) with engineering details in Bugzilla 2536939 (https://bugzilla.redhat.com/show_bug.cgi?id=2536939), so monitor those pages and apply the Red Hat errata for Fuse 7, JBoss EAP 7, Single Sign-On 7, and the Camel for Spring Boot 4 build as soon as they publish - upgrading is the only complete fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every instance of Red Hat Build of Apache Camel for Spring Boot 4, Red Hat Fuse 7, JBoss EAP 7, and Red Hat Single Sign-On 7 across the estate and determine which ones expose a network-reachable STOMP listener, then for any confirmed exposure disable the STOMP connector or bind it to loopback only, or block the STOMP port at the perimeter and between internal segments, and confirm patch status directly against Red Hat's advisory for CVE-2026-93560 since no vendor fix version has been published. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Fuse 7
View allHTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Mismatched handling of the HTTP/1 absolute-form request authority in Red Hat build of Quarkus and other affected Red Hat
Jolokia's JSR-160 proxy in multiple Red Hat middleware products allows network-accessible unauthenticated attackers (per
Denial-of-service in Undertow's WebSocket permessage-deflate implementation allows unauthenticated remote attackers to e
Remote code execution in Red Hat Apache Camel Infinispan component allows low-privileged attackers to execute arbitrary
Undertow's WebSocket subsystem fails to enforce configurable upper bounds on message buffer sizes and session timeouts,
Unauthenticated remote file read in RESTEasy's SourceProvider component allows network attackers to exfiltrate arbitrary
Improper handling of HTTP/2 and HTTP/3 Extended CONNECT requests in Netty-based services can downgrade them to ordinary
SMTP command injection in Netty's netty-codec-smtp allows unauthenticated remote attackers to inject arbitrary SMTP comm
Malformed HTTP/2 CONNECT stream injection in Red Hat JBoss EAP and the wider Red Hat middleware stack (Quarkus, Keycloak
Share
External POC / Exploit Code
Leaving vuln.today