Description
A flaw was found in Netty's StompSubframeDecoder component. A remote attacker can exploit this vulnerability by sending a specially crafted STOMP frame body without its terminating null byte. This causes the decoder to allocate a ByteBuf (a buffer for bytes) that is never released, leading to a permanent memory leak. Over time, this uncontrolled memory consumption can result in a Denial of Service (DoS) for the application using the affected STOMP codec.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Red Hat Red Hat build of Apache Camel for Spring Boot 4
Default version status: affected
Red Hat Red Hat Fuse 7
Default version status: unaffected
Red Hat Red Hat JBoss Enterprise Application Platform 7
Default version status: affected
Red Hat Red Hat JBoss Enterprise Application Platform 7
Default version status: affected
Red Hat Red Hat JBoss Enterprise Application Platform 7
Default version status: affected
Red Hat Red Hat JBoss Enterprise Application Platform 7
Default version status: affected
Red Hat Red Hat Single Sign-On 7
Default version status: affected