CVE-2026-93560 Io.netty/netty-codec-stomp: netty: stomp codec content-length long-to-int truncation causes infinite decode loop dos
A remote attacker can cause a Denial of Service by sending a crafted STOMP frame with an oversized content-length header, triggering an infinite decode loop.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-93560?
CVE-2026-93560 is a high-severity vulnerability in Red Hat Fuse 7, published on 18 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-length header exceeding the maximum integer value. This integer truncation vulnerability could lead to an infinite decode loop, causing a Denial of Service (DoS) by exhausting memory and CPU resources.
Weakness: CWE-1035
Which versions are affected by CVE-2026-93560?
How do I fix CVE-2026-93560?
Upgrade to a fixed version.
Is CVE-2026-93560 being exploited?
There is no known exploitation of CVE-2026-93560 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-93560, GHSA-258j-9683-m467, UBUNTU-CVE-2026-93560.