ChangeIntel IT change radar

Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-93560

Red Hat build of Apache Camel for Spring Boot 4 · Vulnerability

CVSS 3.1 7.5 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory.

cve-program · CVE-2026-93560

Published

A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-length header exceeding the maximum integer value. This integer truncation vulnerability could lead to an infinite decode loop, causing a Denial of Service (DoS) by exhausting memory and CPU resources.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-93560

Published

netty-codec-stomp

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat build of Apache Camel for Spring Boot 4",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "netty-codec-stomp",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:camel_spring_boot:4"
                    ]
                }

netty-codec-stomp

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Fuse 7",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "netty-codec-stomp",
                    "defaultStatus": "unknown",
                    "cpes": [
                        "cpe:/a:redhat:jboss_fuse:7"
                    ]
                }

jboss-eap-7/eap74-els-openjdk11-openshift-rhel8

https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat JBoss Enterprise Application Platform 7",
                    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
                    "packageName": "jboss-eap-7/eap74-els-openjdk11-openshift-rhel8",
                    "defaultStatus": "unknown",
                    "cpes": [
                        "cpe:/a:redhat:jboss_enterprise_application_platform:7"
                    ]
                }

jboss-eap-7/eap74-els-openjdk17-openshift-rhel8

https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat JBoss Enterprise Application Platform 7",
                    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
                    "packageName": "jboss-eap-7/eap74-els-openjdk17-openshift-rhel8",
                    "defaultStatus": "unknown",
                    "cpes": [
                        "cpe:/a:redhat:jboss_enterprise_application_platform:7"
                    ]
                }

jboss-eap-7/eap74-els-openjdk8-openshift-rhel8

https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat JBoss Enterprise Application Platform 7",
                    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
                    "packageName": "jboss-eap-7/eap74-els-openjdk8-openshift-rhel8",
                    "defaultStatus": "unknown",
                    "cpes": [
                        "cpe:/a:redhat:jboss_enterprise_application_platform:7"
                    ]
                }

netty-codec-stomp

https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat JBoss Enterprise Application Platform 7",
                    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
                    "packageName": "netty-codec-stomp",
                    "defaultStatus": "unknown",
                    "cpes": [
                        "cpe:/a:redhat:jboss_enterprise_application_platform:7"
                    ]
                }

netty-codec-stomp

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat Single Sign-On 7",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "netty-codec-stomp",
                    "defaultStatus": "unknown",
                    "cpes": [
                        "cpe:/a:redhat:red_hat_single_sign_on:7"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON