Executive brief
Netty's STOMP codec is a network protocol handler used in messaging applications. A memory leak allows a remote attacker to exhaust server memory by sending incomplete frame messages, one buffer per connection, causing the application to eventually run out of memory and crash. No authentication is required since the attack begins immediately upon connection.
Technical details
The StompSubframeDecoder allocates a ByteBuf and stores it in an instance field while waiting for a terminating NUL byte after the frame body is received. If the byte never arrives, the buffer is never released because: (1) the replay Signal thrown extends Error not Exception, bypassing the catch(Exception) release path; (2) the decoder does not override handlerRemoved0 or channelInactive to clean up. A remote peer can leak one buffer per connection by sending a complete frame body without the terminating byte, causing monotonic memory exhaustion with the default PooledByteBufAllocator.
Affected products
- Netty netty-codec-stomp up to 4.1.137.Final; 4.2.0.Final through 4.2.17.Final
Timeline
- 2026-09-26: disclosed
- 2026-09-26: patched: Fixed in 4.1.138.Final and 4.2.18.Final