Skip to content
OpenAdvisories
High · 7.5 CVE-2026-44891 EUVD-2026-45316GHSA-vhch-2wf3-m8rp

Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder

Published Jul 17, 2026 · Updated Jul 20, 2026 · Assigned by GitHub_M

Vendor: netty Product: netty Package: celeborn-0.6 Package: io.netty:netty-codec-stomp Package: management-api-for-apache-cassandra-5.0 Package: netty Package: netty Package: tez Package: thingsboard-tb-mqtt-transport Package: thingsboard-tb-node Package: trino Package: trino-plugin-bigquery Package: trino-plugin-delta-lake Package: trino-plugin-hive Package: trino-plugin-hudi Package: trino-plugin-iceberg Package: trino-plugin-lakehouse Package: trino-plugin-opensearch Package: trino-plugin-oracle Package: trino-plugin-pinot Package: trino-plugin-teradata-functions Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, and the maxLineLength parameter only restricts individual header lines. An attacker can send a large number of short headers that are accumulated in memory inside DefaultStompHeadersSubframe until the JVM throws an OutOfMemoryError, causing denial of service for servers exposing a STOMP endpoint based on StompSubframeDecoder. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

Affected products

VendorProductAffectedFixed
netty netty < 4.1.136.Final, >= 4.2.0.Final, < 4.2.16.Final —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 netty No fix yet —
Debian 13 netty No fix yet —
Debian 12 netty No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 netty No fix yet —
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 26.04 LTS netty No fix yet —
Ubuntu Pro 24.04 LTS netty No fix yet —
Ubuntu Pro 22.04 LTS netty No fix yet —
Ubuntu Pro 20.04 LTS netty No fix yet —
Ubuntu Pro 18.04 LTS netty No fix yet —
Ubuntu Pro 16.04 LTS netty No fix yet —
Ubuntu Pro 14.04 LTS netty No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 netty 4.1.136-150200.4.53.1 SUSE-SU-2026:3482-1
SLES 15 SP7 netty-tcnative 2.0.80-150200.3.48.1 SUSE-SU-2026:3482-1
SLES 15 SP6 netty-tcnative 2.0.80-150200.3.48.1 SUSE-SU-2026:3482-1
SLES 15 SP5 netty-tcnative 2.0.80-150200.3.48.1 SUSE-SU-2026:3482-1
SLES 15 SP4 netty-tcnative 2.0.80-150200.3.48.1 SUSE-SU-2026:3482-1
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP6 netty-tcnative 2.0.80-150200.3.48.1 SUSE-SU-2026:3482-1
SLES for SAP 15 SP5 netty-tcnative 2.0.80-150200.3.48.1 SUSE-SU-2026:3482-1
SLES for SAP 15 SP4 netty-tcnative 2.0.80-150200.3.48.1 SUSE-SU-2026:3482-1
SLE HPC 15 SP5 netty-tcnative 2.0.80-150200.3.48.1 SUSE-SU-2026:3482-1
SLE HPC 15 SP4 netty-tcnative 2.0.80-150200.3.48.1 SUSE-SU-2026:3482-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed netty 4.1.136-1.1 openSUSE-SU-2026:11394-1

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling celeborn-0.6 0.6.3-r10 —
Wolfi rolling management-api-for-apache-cassandra-5.0 0.1.122-r2 —
Wolfi rolling tez 0.10.5-r20 —
Wolfi rolling thingsboard-tb-node +1 4.3.1.3-r4 —
Wolfi rolling trino +4 483-r7 —
Wolfi rolling trino-plugin-hive +5 483-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven io.netty:netty-codec-stomp >= 4.2.0.Alpha1, < 4.2.16.Final 4.2.16.Final GHSA-vhch-2wf3-m8rp
Maven io.netty:netty-codec-stomp < 4.1.136.Final 4.1.136.Final GHSA-vhch-2wf3-m8rp

Advisories 3

References