CVE-2026-44891

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.136.Final Netty versions prior to 4.2.16.Final

Description The io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame. While the maxLineLength parameter restricts the length of individual header lines, there is no mechanism to limit the total quantity of headers in a single STOMP frame. An attacker can send a large number of short headers that are accumulated in memory within the DefaultStompHeadersSubframe until the JVM throws an OutOfMemoryError, resulting in a denial of service for servers exposing a STOMP endpoint.

Recommendations Update to version 4.1.136.Final or later. Update to version 4.2.16.Final or later.