CVE-2026-93494 Io.netty/netty-codec-stomp: netty: bytebuf leak in stompsubframedecoder when a frame body is never terminated
A remote attacker can cause a permanent memory leak and subsequent denial of service by sending STOMP frames without terminating null bytes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-93494?
CVE-2026-93494 is a high-severity denial of service vulnerability in Red Hat Fuse 7, published on 18 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in Netty's StompSubframeDecoder component. A remote attacker can exploit this vulnerability by sending a specially crafted STOMP frame body without its terminating null byte. This causes the decoder to allocate a ByteBuf (a buffer for bytes) that is never released, leading to a permanent memory leak. Over time, this uncontrolled memory consumption can result in a Denial of Service (DoS) for the application using the affected STOMP codec.
Weakness: CWE-1035
Which versions are affected by CVE-2026-93494?
How do I fix CVE-2026-93494?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-93494 being exploited?
There is no known exploitation of CVE-2026-93494 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-93494, GHSA-xvr4-c5q3-q5wm, UBUNTU-CVE-2026-93494.