{"id":"CVE-2026-93494","revision":"86ca891275ce4d079603fe80f1434a49","records":[{"revision":"86ca891275ce4d079603fe80f1434a49","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-93494","aliases":[],"title":"Io.netty/netty-codec-stomp: netty: bytebuf leak in stompsubframedecoder when a frame body is never terminated","description":"A flaw was found in Netty's StompSubframeDecoder component. A remote attacker can exploit this vulnerability by sending a specially crafted STOMP frame body without its terminating null byte. This causes the decoder to allocate a ByteBuf (a buffer for bytes) that is never released, leading to a permanent memory leak. Over time, this uncontrolled memory consumption can result in a Denial of Service (DoS) for the application using the affected STOMP codec.","state":0,"publishedAt":"2026-09-18T07:39:17.069+00:00","modifiedAt":"2026-09-25T08:02:02.576+00:00","affected":[{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"netty-codec-stomp","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat build of Apache Camel for Spring Boot 4\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"netty-codec-stomp\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:camel_spring_boot:4\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"netty-codec-stomp","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Fuse 7\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"netty-codec-stomp\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:jboss_fuse:7\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","name":"jboss-eap-7/eap74-els-openjdk11-openshift-rhel8","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat JBoss Enterprise Application Platform 7\",\n                    \"collectionURL\": \"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html\",\n                    \"packageName\": \"jboss-eap-7/eap74-els-openjdk11-openshift-rhel8\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:jboss_enterprise_application_platform:7\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","name":"jboss-eap-7/eap74-els-openjdk17-openshift-rhel8","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat JBoss Enterprise Application Platform 7\",\n                    \"collectionURL\": \"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html\",\n                    \"packageName\": \"jboss-eap-7/eap74-els-openjdk17-openshift-rhel8\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:jboss_enterprise_application_platform:7\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","name":"jboss-eap-7/eap74-els-openjdk8-openshift-rhel8","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat JBoss Enterprise Application Platform 7\",\n                    \"collectionURL\": \"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html\",\n                    \"packageName\": \"jboss-eap-7/eap74-els-openjdk8-openshift-rhel8\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:jboss_enterprise_application_platform:7\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","name":"netty-codec-stomp","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat JBoss Enterprise Application Platform 7\",\n                    \"collectionURL\": \"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html\",\n                    \"packageName\": \"netty-codec-stomp\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:jboss_enterprise_application_platform:7\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"netty-codec-stomp","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Single Sign-On 7\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"netty-codec-stomp\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:red_hat_single_sign_on:7\"\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://access.redhat.com/security/cve/CVE-2026-93494","https://bugzilla.redhat.com/show_bug.cgi?id=2536898"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-93494","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-93494","identifiers":["CVE-2026-93494"]},"retained":false,"historicalAffected":[]}],"coverage":[]}