AIKIDO-2026-994731
netty-codec-stomp is vulnerable to Denial of Service (DoS)
53
Medium Risk
This Affects:
netty-codec-stompTL;DR
In StompSubframeDecoder the frame contentLength is held as a long but the running read count is an int. A crafted STOMP frame declaring an oversized content-length causes the count to truncate so the loop's termination condition is never met. The decoder then spins in an infinite loop, exhausting CPU and memory. The fix aligns the numeric types so the comparison terminates correctly.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application decodes STOMP frames from untrusted peers.
Background info
netty-codec-stomp is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 4.1.137.Final and 4.2.0.Final - 4.2.17.Final.
How to fix this
Upgrade the io.netty:netty-codec-stomp library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.