7.5
Élevée
CVE-2026-93494 A flaw was found in Netty's StompSubframeDecoder component
Description
A flaw was found in Netty's StompSubframeDecoder component. A remote attacker can exploit this vulnerability by sending a specially crafted STOMP frame body without its terminating null byte. This causes the decoder to allocate a ByteBuf (a buffer for bytes) that is never released, leading to a permanent memory leak. Over time, this uncontrolled memory consumption can result in a Denial of Service (DoS) for the application using the affected STOMP codec.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat build of Apache Camel for Spring Boot 4 | Versions non publiées | |
| Red Hat Fuse 7 | Versions non publiées | |
| Red Hat JBoss Enterprise Application Platform 7 | Versions non publiées | |
| Red Hat Single Sign-On 7 | Versions non publiées |
Autres CVE de Red Hat build of Apache Camel for Spring Boot 4
Les 106 CVE de Red Hat build of Apache Camel for Spring Boot 4 →
CVE-2026-91920
Undertow: undertow: chunkreader message length permits chunk-size overflow
6.5
Moyenne
CVE-2026-114370
Undertow: undertow: pathresourcemanager safepaths check allows sibling-directory symlink traversal
3.7
Faible
CVE-2026-93562
Io.netty/netty-codec-http: netty: incomplete validation of malformed transfer-encoding allows http request smuggling
6.5
Moyenne
CVE-2026-93574
Io.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsing
6.5
Moyenne