CVE-2026-93494 Red Hat CVE debrief

Who should care

Defenders responsible for applications using the Netty STOMP codec should assess exposure and prioritize patching or applying workarounds to prevent potential DoS attacks. This includes verifying affected versions, applying patches or workarounds, and monitoring for potential attacks. Security teams and vulnerability management teams should review the vulnerability and its potential impact on the organization.

Why it matters

CVE-2026-93494 is a memory leak vulnerability in Netty's StompSubframeDecoder component that can lead to Denial of Service (DoS). Defenders should assess exposure, prioritize patching, and monitor for potential attacks.

• Potential Denial of Service (DoS) due to uncontrolled memory consumption
• Need to verify affected versions and apply patches or workarounds
• Possible impact on application availability and performance

Technical summary

The StompSubframeDecoder component in Netty is vulnerable to a memory leak. A remote attacker can send a specially crafted STOMP frame body without its terminating null byte, causing the decoder to allocate a ByteBuf that is never released. This leads to uncontrolled memory consumption, potentially resulting in a Denial of Service (DoS) for the application using the affected STOMP codec. The vulnerability affects applications using the Netty STOMP codec, and defenders should assess exposure and prioritize patching or applying workarounds.

Defensive priority

Defenders should prioritize verifying affected versions and applying patches or workarounds to prevent potential DoS attacks.

Recommended defensive actions

• Verify if the application using the affected STOMP codec is vulnerable and assess exposure
• Check for and apply patches or workarounds provided by the vendor
• Monitor for potential DoS attacks and adjust defensive measures accordingly
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information on affected versions and patches is limited. Defenders should verify if the application using the affected STOMP codec is vulnerable and assess exposure. The vulnerability can lead to uncontrolled memory consumption, potentially resulting in a Denial of Service (DoS) for the application using the affected STOMP codec. Additional verification tasks are required to confirm affected scope and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.