CVE-2026-100657

Netty's STOMP codec (io.netty:netty-codec-stomp) contains a ByteBuf leak in StompSubframeDecoder. Once a frame's declared content-length has been fully read, the decoder allocates a chunk buffer from the channel allocator and parks it in an instance field while waiting for the single NUL byte that terminates the frame. If that byte never arrives, the buffer is never released: the replay Signal thrown by skipNullCharacter extends Error rather than Exception, so the decoder's catch(Exception) release path does not run, and StompSubframeDecoder overrides neither handlerRemoved0 nor channelInactive, so the buffer also survives channel teardown. A remote peer can leak one allocator buffer per connection by sending a complete, well-formed frame body and withholding its terminating NUL byte; with the default pooled allocator the memory is never returned to the pool or reclaimed by garbage collection, so the leak accumulates for the lifetime of the process and can lead to memory exhaustion. This affects versions up to and including 4.1.137.Final and versions 4.2.0.Final through 4.2.17.Final; it is fixed in 4.1.138.Final and 4.2.18.Final.

• CWE-772

• https://github.com/netty/netty/security/advisories/GHSA-ghg5-c4jg-8q5j
• https://www.vulncheck.com/advisories/netty-before-4.1.138-final-bytebuf-leak-in-stompsubframedecoder

Published

Sep 26, 2026

Last Modified

Sep 26, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-100651vLLM before 0.29.0 fails to enforce decoder prompt-length va…6.5
• CVE-2026-100652vLLM versions 0.22.0 through 0.23.0 fail to validate stop_to…5.9
• CVE-2026-100653vLLM is an inference and serving engine for large language m…6.5
• CVE-2026-100654vLLM before 0.29.0 accepts user-controlled stop_token_ids on…6.5
• CVE-2026-100655Netty (io.netty:netty-codec-http) versions up to and includi…7.5
• CVE-2026-100656Netty (io.netty:netty-codec-http) contains an unbounded per-…7.5
• CVE-2026-100658Netty (io.netty:netty-codec-http) contains an unbounded per-…5.3
• CVE-2026-100659Netty's HTTP/3 codec (io.netty:netty-codec-http3) in version…6.5
• CVE-2026-10066A security vulnerability has been detected in Shibby Tomato …8.8
• CVE-2026-100660Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.0…7.5
• CVE-2026-100661Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4…7.5
• CVE-2026-100662Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4…7.5