7.5
High
CVE-2026-93560 A flaw was found in the Netty STOMP codec
Description
A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-length header exceeding the maximum integer value. This integer truncation vulnerability could lead to an infinite decode loop, causing a Denial of Service (DoS) by exhausting memory and CPU resources.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat build of Apache Camel for Spring Boot 4 | Versions not published | |
| Red Hat Fuse 7 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform 7 | Versions not published | |
| Red Hat Single Sign-On 7 | Versions not published |
Other CVEs of Red Hat build of Apache Camel for Spring Boot 4
The 106 CVEs of Red Hat build of Apache Camel for Spring Boot 4 →
CVE-2026-91920
Undertow: undertow: chunkreader message length permits chunk-size overflow
6.5
Medium
CVE-2026-114370
Undertow: undertow: pathresourcemanager safepaths check allows sibling-directory symlink traversal
3.7
Low
CVE-2026-93562
Io.netty/netty-codec-http: netty: incomplete validation of malformed transfer-encoding allows http request smuggling
6.5
Medium
CVE-2026-93574
Io.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsing
6.5
Medium