Apache Camel CVE-2026-93560

Requires the affected application (Red Hat Fuse 7, Single Sign-On 7, JBoss EAP 7, or Build of Apache Camel for Spring Boot 4) to expose and process STOMP protocol frames through the vulnerable Netty-based STOMP codec; the attacker must be able to send a raw STOMP frame with a content-length value that overflows the long-to-int conversion. No authentication or user interaction is needed (PR:N/UI:N), but exploitation is limited to deployments where a STOMP listener/endpoint is actually enabled and network-reachable - products where STOMP is not configured are not exposed.

This is a legitimate but bounded availability risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes an unauthenticated, low-complexity, remotely-reachable denial of service with no confidentiality or integrity impact - the score is driven entirely by A:H. A long-to-int truncation of the STOMP frame content-length header causes the decoder to enter an infinite loop, consuming CPU and hanging the processing thread until the service is restarted. No EPSS score, CISA KEV entry, or public exploit code is present in the provided data, so exploitation status is 'no public exploit identified at time of analysis' - this is a disclosed defect, not a demonstrated active threat. The 7.5 rating is realistic for its impact class but should be prioritized as a stability/DoS issue rather than a system-compromise emergency: there is no code execution or data exposure path. A key limiting factor not captured in the raw CVSS is that exploitation requires the target application to actually expose and process STOMP protocol frames via the affected Netty-based codec - many deployments of the listed Red Hat products never enable a STOMP endpoint. Note also a metadata conflict: the CWE (CWE-1035) is an OWASP category identifier rather than a specific weakness, and the 'Information Disclosure' tag contradicts the C:N/I:N/A:H vector.

An attacker with network reachability to a STOMP endpoint exposed by an affected Red Hat middleware instance sends a single crafted STOMP frame whose content-length header value overflows the long-to-int conversion. The malformed length drives the codec into an infinite decode loop, pinning a processing thread and denying service until the process is restarted. No authentication or user interaction is required; no public exploit code is identified at time of analysis.