Advisory · CVE-2026-100657
Netty STOMP decoder leaks one buffer per connection until memory runs out
Netty's StompSubframeDecoder allocates a chunk buffer while waiting for a frame's terminating NUL byte and never releases it if the byte never arrives. A remote peer can leak one allocator buffer per connection by sending a well-formed frame body and withholding the NUL terminator, accumulating memory for the process lifetime. Fixed in 4.1.138.Final and 4.2.18.Final.
- Vendor
- Netty
- Product
- Netty
- Identifier / CWE
- CVE-2026-100657
CWE-772 - Action timing
- Immediate
Explain it like I’m five
The mailroom holds a box for every letter waiting for its final stamp. If the stamp never comes, the box is never thrown away, and the room slowly fills with boxes until no one can move.
- 01Frame body sent
The remote peer sends a well-formed STOMP frame body over the connection.
- 02NUL withheld
The terminating NUL byte never arrives, so the decoder keeps waiting.
- 03Buffer pinned
The allocated chunk buffer is never released while the decoder waits.
- 04Memory exhaustion
Each connection leaks one buffer for the process lifetime, accumulating until the service runs out of memory.
What happened
Netty’s StompSubframeDecoder allocates a chunk buffer while waiting for the terminating NUL byte of a STOMP frame and never releases it if that byte never arrives (CVE-2026-100657, CVSS 8.7). A remote peer can leak one allocator buffer per connection by sending a well-formed frame body and withholding the NUL terminator, accumulating memory for the process lifetime until the service exhausts memory. No authentication is required, only STOMP protocol reachability. The issue is fixed in Netty 4.1.138.Final and 4.2.18.Final.
What to do
- Upgrade Netty to 4.1.138.Final or 4.2.18.Final.
- If you expose STOMP endpoints, watch for connection counts climbing without corresponding traffic, a signature of this leak.
- Restart affected services after upgrading to clear any memory already pinned by waiting connections.
Management note
Messaging endpoints are exactly the kind of always-on, always-reachable surface this flaw loves. If you run STOMP over Netty anywhere, treat the upgrade as routine but not optional.