CVE-2026-100657 netty CVE debrief

Who should care

Defenders responsible for Netty-based systems, particularly those using the STOMP codec, should assess exposure and prioritize remediation or compensating controls to prevent potential memory exhaustion.

Why it matters

CVE-2026-100657 is a high-severity vulnerability in Netty's STOMP codec that can lead to memory exhaustion. Defenders should prioritize verifying exposure, upgrading to fixed versions, or applying compensating controls to limit the impact of potential memory exhaustion.

• Memory exhaustion due to accumulation of leaked ByteBuf instances.
• Potential denial-of-service (DoS) due to memory exhaustion.
• Need for verification of exposure and affected versions.
• Priority for upgrading to fixed versions or applying compensating controls.

Technical summary

The Netty STOMP codec (io.netty:netty-codec-stomp) contains a ByteBuf leak in StompSubframeDecoder. A remote peer can cause a leak by sending a complete, well-formed frame body and withholding its terminating NUL byte. The issue affects versions up to and including 4.1.137.Final and versions 4.2.0.Final through 4.2.17.Final, and is fixed in 4.1.138.Final and 4.2.18.Final. This vulnerability can lead to memory exhaustion and potential denial-of-service (DoS) attacks. Defenders should prioritize verifying exposure, upgrading to fixed versions, or applying compensating controls to limit the impact of potential memory exhaustion.

Defensive priority

Defenders should prioritize verifying exposure and upgrading to fixed versions, 4.1.138.Final or 4.2.18.Final, or applying compensating controls to limit the impact of potential memory exhaustion.

Recommended defensive actions

• Verify exposure by checking if the used Netty version is within the affected range.
• Upgrade to a fixed version, 4.1.138.Final or 4.2.18.Final, if possible.
• Apply compensating controls to limit the impact of potential memory exhaustion.
• Monitor for unusual memory usage and adjust system configurations as needed.
• Review system logs for signs of memory exhaustion and potential DoS.
• Perform regular security audits to identify and address potential vulnerabilities.
• Implement additional monitoring and alerting for memory usage and system performance.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. Additional information is available from source references, including GitHub and Vulncheck.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.