CVE-2026-93494 Red Hat CVE debrief

Who should care

Defenders responsible for applications using the Netty library, particularly those utilizing the STOMP codec, should assess exposure and potential impact. This includes operators, platform administrators, vulnerability management teams, and security teams. They should verify exposure, assess potential impact, and prioritize remediation based on vendor guidance.

Why it matters

CVE-2026-93494 is a memory leak vulnerability in Netty's StompSubframeDecoder component that can lead to Denial of Service (DoS). Defenders should verify exposure, assess impact, and prioritize remediation based on vendor guidance.

• Potential Denial of Service (DoS) due to uncontrolled memory consumption
• Need to verify exposure and assess potential impact on applications
• Remediation priority based on vendor-provided information

Technical summary

The vulnerability is caused by a flaw in Netty's StompSubframeDecoder component, which can be exploited by sending a specially crafted STOMP frame body without its terminating null byte. This leads to a permanent memory leak, potentially resulting in a Denial of Service (DoS) for the application using the affected STOMP codec. The vulnerability affects applications using the STOMP codec and can be exploited by remote attackers to cause Denial of Service (DoS). Defenders should prioritize verifying exposure and assessing potential impact on applications using the affected STOMP codec.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact on applications using the affected STOMP codec.

Recommended defensive actions

• Verify exposure by checking application usage of the affected STOMP codec
• Assess potential impact on applications using the affected component
• Monitor for potential Denial of Service (DoS) attacks
• Review vendor-provided information for remediation guidance
• Apply vendor patches or updates to affected systems
• Implement compensating controls for exposed systems
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information on affected versions and remediation is limited. Defenders should verify exposure by checking application usage of the affected STOMP codec and assess potential impact on applications. The vulnerability is publicly known and may be exploited by attackers to cause Denial of Service (DoS).

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.