378 matches found
legba
legba Join the project community on our server! Legba is a multiprotocol credentials bruteforcer / password sprayer and enumerator built with Rust and the Tokio asynchronous runtime in order to achieve better performances and stability while consuming less resources than similar tools. Key Featur...
CVE-2026-118487
In Eclipse Vert.x versions 4.0.0, 4.5.35 or 5.0.0, 5.2.2, the FrameParser in vertx-stomp creates a RecordParser without setting maxRecordSize, so any peer that streams bytes continuously without a newline character causes the parser to accumulate data indefinitely. Both the STOMP server and the...
CVE-2026-118487 Heap exhaustion via unbounded line accumulation in Vert.x STOMP FrameParser
In Eclipse Vert.x versions 4.0.0, 4.5.35 or 5.0.0, 5.2.2, the FrameParser in vertx-stomp creates a RecordParser without setting maxRecordSize, so any peer that streams bytes continuously without a newline character causes the parser to accumulate data indefinitely. Both the STOMP server and the...
EUVD-2026-115915
In Eclipse Vert.x versions 4.0.0, 4.5.35 or 5.0.0, 5.2.2, the FrameParser in vertx-stomp creates a RecordParser without setting maxRecordSize, so any peer that streams bytes continuously without a newline character causes the parser to accumulate data indefinitely. Both the STOMP server and the...
CVE-2026-118487
Eclipse Vert.x versions [4.0.0, 4.5.35] and [5.0.0, 5.2.2] are vulnerable to a heap exhaustion flaw in the FrameParser component of vertx-stomp . The root cause is the creation of a RecordParser without specifying a maxRecordSize, allowing a peer to stream bytes continuously without a newline cha...
CVE-2026-118487: Eclipse Foundation Eclipse Vert.x: In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], the `FrameParser` in vertx-stomp creates a `RecordParser`…
In Eclipse Vert.x versions 4.0.0, 4.5.35 or 5.0.0, 5.2.2, the FrameParser in vertx-stomp creates a RecordParser without setting maxRecordSize, so any peer that streams bytes continuously without a newline character causes the parser to accumulate data indefinitely. Both the STOMP server and the...
CLEANSTART-2026-KK64294 vulnerability exists in Apache Artemis whereby an application using the STOMP protocol with security credentials that grant either the consume or send permission on an address can augment the routi...
Security vulnerability affects the wildfly package. A vulnerability exists in Apache Artemis whereby an application using the STOMP protocol with security credentials that grant either the consume or send permission on an address can augment the routing-type supported by that address even if said...
Security Bulletin:Multiple vulnerabilities in netty-codec-stomp may affect IBM Infosphere Change Data Capture (CVE-2026-93494, CVE-2026-93560)
Summary Multiple security vulnerabilities have been identified in netty-codec-stomp, Netty/Codec/Stomp. netty-codec-stomp is used by IBM Infosphere Change Data Capture. IBM has addressed these vulnerabilities. Refer to the "Remediation/Fixes" section below for remediation details. Vulnerability...
Integer Truncation
io.netty, netty-codec-stomp is vulnerable to an integer truncation. The vulnerability is due to improper handling of a content-length header exceeding the maximum integer value, which allows a remote attacker to send a specially crafted STOMP frame, triggering an infinite decoding loop and...
CVE-2026-67230
A flaw was found in RabbitMQ. When the Web STOMP plugin is enabled, the WebSocket handler fails to enforce maximum frame size limits or login timeouts prior to client authentication. An unauthenticated remote attacker can exploit this vulnerability by sending a continuous stream of small frames t...
RHLW-2026-8279A9B7F6BB0BE6 Lightwell Security Advisory: spring-messaging 5.3.18.rhlw-00010
Red Hat Lightwell has released org.springframework:spring-messaging 5.3.18.rhlw-00010 with a backported security fix. CVE-2022-22971: In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of...
RHLW-2026-B66720D53A6E2BA6 Lightwell Security Advisory: netty-codec-stomp 4.1.100.Final-rhlw-00001
Red Hat Lightwell has released io.netty:netty-codec-stomp 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2026-44891 and CVE-2026-59920. CVE-2026-44891: Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder CVE-2026-59920: Netty: STOMP CONNECT Frame Header Injection This...
Security Bulletin:RabbitMQ Web STOMP WebSocket Handler Vulnerability: Unbounded Pre-Authentication State
Summary RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the Web STOMP WebSocket handler enforced neither maxframesize nor logintimeout before authentication, allowing an unauthenticated client to keep a connection alive with a slow stream of sma...
BIT-RABBITMQ-2026-67405 RabbitMQ: CSWSH on Web-STOMP / Web-MQTT (no Origin validation)
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, Neither the Web-MQTT handler deps/rabbitmqwebmqtt/src/rabbitwebmqtthandler.erl:104 nor the Web-STOMP handler deps/rabbitmqwebstomp/src/rabbitwebstomphandler.erl:102 validates the Origin head...
PT-2026-105192
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, Neither the Web-MQTT handler deps/rabbitmq web mqtt/src/rabbit web mqtt handler.erl:104 nor the Web-STOMP handler deps/rabbitmq web stomp/src/rabbit web stomp handler.erl:102 validates the...
PT-2026-105178
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the Web STOMP WebSocket handler enforced neither max frame size nor login timeout before authentication, allowing an unauthenticated client to keep a connection alive with a slow stream of small...
SUSE CVE-2026-67230
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the Web STOMP WebSocket handler enforced neither maxframesize nor logintimeout before authentication, allowing an unauthenticated client to keep a connection alive with a slow stream of small frame...
CVE-2026-100657
A flaw was found in the Netty STOMP codec. A remote attacker can trigger a memory leak by sending a complete frame body while withholding the terminating null byte, which prevents the allocated buffer from being released even after the connection is closed. Over time, repeated connections can cau...
Linux Distros Unpatched Vulnerability : CVE-2026-100657
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty's STOMP codec io.netty:netty-codec-stomp contains a ByteBuf leak in StompSubframeDecoder. Once a frame's declared content-length has been fully read, the...