CVE-2026-100657

A flaw in the Netty STOMP codec (netty-codec-stomp), rated Important by Red Hat, affects Red Hat products that ship and use this component, including Red Hat Single Sign-On 7 and the Red Hat build of Apache Camel 4. A remote, unauthenticated attacker can connect to a service that uses the Netty STOMP codec and send a complete, well-formed STOMP frame body while withholding the single NUL byte that terminates the frame. The decoder allocates a buffer for the frame content but never releases it: the replay signal used while waiting for the terminator is not caught by the decoder's exception cleanup path, and the decoder has no release path at channel teardown. With the default pooled allocator the leaked memory is neither returned to the pool nor reclaimed by garbage collection, even after the connection is closed, so an attacker can repeat the pattern to consume memory monotonically until the service fails from memory exhaustion. The issue is reachable before any application-level authentication, because a STOMP frame can be sent immediately on connect. Within Red Hat's product set, only applications that actually process STOMP frames with this codec are exposed. Red Hat JBoss Fuse 7 ships the component but is not affected because the vulnerable code is not in the execute path. For the affected products where the component is used, a fix is being pursued through the respective product streams; for Red Hat JBoss Enterprise Application Platform 7.4, which ships the affected component, a fix is not currently planned. Red Hat and upstream CVSS v3 scores are identical (7.5, Important); upstream additionally publishes a CVSS v4 score of 8.7.