CVE-2026-93560: Io.netty/netty-codec-stomp: netty: stomp codec content-length long-to-int truncation causes infinite decode loop dos

Q: Does exploitation require authentication or user interaction?

No. The severity vector indicates network reachability, low attack complexity, no privileges required, and no user interaction required.

Q: What input causes the decoder to enter the loop?

A STOMP frame with a non-negative content-length that exceeds the signed 32-bit integer range can trigger truncation. The documented example is content-length: 2147483648, which becomes a negative remaining length after casting to int.

Q: What is the expected security impact?

The stated impact is denial of service through an infinite decode loop. The provided severity vector indicates availability impact without confidentiality or integrity impact.

Published Sep 18, 2026

Updated

STOMP codec content-length long-to-int truncation causes infinite decode loop DoS

Affected Software

2 affected components

maven/io.netty/netty-codec-stomp>=4.2.0.Final<=4.2.17.Final

maven/io.netty/netty-codec-stomp<=4.1.137.Final

Event History

Sep 18, 2026

Data Sourced

via Red Hat·09:45 AM

DescriptionSeverityAffected Software

CVE Published

via MITRE·01:44 PM

Data Sourced

via MITRE·01:44 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Does exploitation require authentication or user interaction?

No. The severity vector indicates network reachability, low attack complexity, no privileges required, and no user interaction required.

What input causes the decoder to enter the loop?

A STOMP frame with a non-negative content-length that exceeds the signed 32-bit integer range can trigger truncation. The documented example is content-length: 2147483648, which becomes a negative remaining length after casting to int.

What is the expected security impact?