PT-2026-60063 · Netty · Netty

Published 2026-07-14 · Updated 2026-07-15 · CVE-2026-44891

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Netty (affected versions not specified)

Description The io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame. While the maxLineLength parameter restricts the length of individual header lines, the lack of a limit on the total number of headers allows an attacker to send a large volume of short headers. These are accumulated in memory within the DefaultStompHeadersSubframe until the JVM throws an OutOfMemoryError, resulting in a Denial of Service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

CVE-2026-44891

GHSA-VHCH-2WF3-M8RP

Affected Products

Netty

References · 4

• https://osv.dev/vulnerability/GHSA-vhch-2wf3-m8rp · Vendor Advisory
• https://github.com/netty/netty/security/advisories/GHSA-vhch-2wf3-m8rp · Note
• https://github.com/netty/netty · Note
• https://twitter.com/dailycve/status/2077296250806759598 · Twitter Post