Netty STOMP codec int truncation can cause DoS
CVE-2026-93560 Published on September 18, 2026

Io.netty/netty-codec-stomp: netty: stomp codec content-length long-to-int truncation causes infinite decode loop dos
A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-length header exceeding the maximum integer value. This integer truncation vulnerability could lead to an infinite decode loop, causing a Denial of Service (DoS) by exhausting memory and CPU resources.

NVD

Vulnerability Analysis

CVE-2026-93560 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
NONE
Integrity Impact:
NONE
Availability Impact:
HIGH

Timeline

Reported to Red Hat.

Made public.

Weakness Type

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.


Products Associated with CVE-2026-93560

Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.

Red Hat Camel Spring Boot
 
Red Hat Jboss Fuse
 
Red Hat Jboss Enterprise Application Platform
 
Red Hat Single Sign On
 

Affected Versions

Red Hat build of Apache Camel for Spring Boot 4: Red Hat Fuse 7: Red Hat JBoss Enterprise Application Platform 7: Red Hat JBoss Enterprise Application Platform 7: Red Hat JBoss Enterprise Application Platform 7: Red Hat JBoss Enterprise Application Platform 7: Red Hat Single Sign-On 7: