Skip to content
OpenAdvisories

Package · Maven

io.netty:netty-codec-stomp

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 6.5
    CVE-2026-59920

    Netty: STOMP CONNECT Frame Header Injection

    Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's STOMP encoder ( StompSubframeEncoder ) does not escape or validate header values in  CONNECT  and  CONNECTED  frames, so raw new…

    netty netty netty netty Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2026-44891

    Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder

    Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame,…

    netty netty thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven