CVE-2026-100657

Rejected reason: This CVE ID has been rejected as a duplicate...

DEBIAN-CVE-2026-100657

Bulletin has no description...

EUVD-2026-87751

Netty's STOMP codec io.netty:netty-codec-stomp contains a ByteBuf leak in StompSubframeDecoder. Once a frame's declared content-length has been fully read, the decoder allocates a chunk buffer from the channel allocator and parks it in an instance field while waiting for the single NUL byte that...

CVE-2026-100657 Netty before 4.1.138.Final ByteBuf Leak in StompSubframeDecoder

Netty's STOMP codec io.netty:netty-codec-stomp contains a ByteBuf leak in StompSubframeDecoder. Once a frame's declared content-length has been fully read, the decoder allocates a chunk buffer from the channel allocator and parks it in an instance field while waiting for the single NUL byte that...

io.netty/netty-codec-stomp: Netty: Denial of Service vulnerability in STOMP decoder

A flaw was found in Netty, a network application framework, specifically within the StompSubframeDecoder component. This vulnerability allows a remote attacker to cause a denial of service DoS by sending a large number of small headers. The decoder fails to properly limit the total number or...

CVE-2026-93560

A Denial of Service vulnerability exists in the Netty STOMP codec (io.netty/netty-codec-stomp). A remote, unauthenticated attacker can send a specially crafted STOMP frame whose content-length header exceeds the maximum integer value. The long-to-int truncation in the decoder causes an infinite d...

CVE-2026-93560 Io.netty/netty-codec-stomp: netty: stomp codec content-length long-to-int truncation causes infinite decode loop dos

A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-length header exceeding the maximum integer value. This integer truncation vulnerability could lead to an infinite decode loop, causing a Denial of Service DoS by exhausting memo...

CVE-2026-93560 Io.netty/netty-codec-stomp: netty: stomp codec content-length long-to-int truncation causes infinite decode loop dos

A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-length header exceeding the maximum integer value. This integer truncation vulnerability could lead to an infinite decode loop, causing a Denial of Service DoS by exhausting memo...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound in StompSubframeDecoder.java, where getContentLength accepts an unbounded long while alreadyReadChunkSize is an int, and the truncating cast at line 149 wraps a value above Integer.MAXVALUE to a negative...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), ai.chronon:service_2.11 (>=def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, <=0.0.115) +4626 more potentially affected by CVE-2026-59920 via io.netty:netty-codec-stomp (>=4.1.0.beta1, <=4.1.135.final)

io.netty:netty-codec-stomp MAVEN version =4.1.0.beta1, =0.0.1, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =3.30.1.1, =3.10.0.5, =0.2.3.5, =0.0.1, =5.1.0, =2.0.21, =2.0.28 and more Source cve...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), ai.chronon:service_2.11 (>=def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, <=0.0.115) +4626 more potentially affected by CVE-2026-59920 via io.netty:netty-codec-stomp (>=4.1.0.beta1, <=4.1.135.final)

io.netty:netty-codec-stomp MAVEN version =4.1.0.beta1, =0.0.1, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =3.30.1.1, =3.10.0.5, =0.2.3.5, =0.0.1, =5.1.0, =2.0.21, =2.0.28 and more Source cve...

ai.spice:spiceai (0.6.0), ch.zzeekk.spark:spark-temporalquery_2.13 (4.0.0) +913 more potentially affected by CVE-2026-44891 via io.netty:netty-codec-stomp (>=4.2.0.alpha1, <=4.2.15.final)

io.netty:netty-codec-stomp MAVEN version =4.2.0.alpha1, =4.2.15.final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty-codec-stomp and may be impacted: - ai.spice:spiceai 0.6.0 - ch.zzeekk.spark:spark-temporalquery2.13 4.0.0 -...

ai.spice:spiceai (0.6.0), ch.zzeekk.spark:spark-temporalquery_2.13 (4.0.0) +913 more potentially affected by CVE-2026-44891 via io.netty:netty-codec-stomp (>=4.2.0.alpha1, <=4.2.15.final)

io.netty:netty-codec-stomp MAVEN version =4.2.0.alpha1, =4.2.15.final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty-codec-stomp and may be impacted: - ai.spice:spiceai 0.6.0 - ch.zzeekk.spark:spark-temporalquery2.13 4.0.0 -...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), ai.chronon:service_2.11 (>=def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, <=0.0.115) +4626 more potentially affected by CVE-2026-44891 via io.netty:netty-codec-stomp (>=4.1.0.beta1, <=4.1.135.final)

io.netty:netty-codec-stomp MAVEN version =4.1.0.beta1, =0.0.1, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =3.30.1.1, =3.10.0.5, =0.2.3.5, =0.0.1, =5.1.0, =2.0.21, =2.0.28 and more Source cve...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the StompSubframeDecoder process. An attacker can exhaust system memory and cause a server crash by sending a large number of short headers in a single STOMP frame, resulting ...