CVE-2026-44891

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, and the maxLineLength parameter only restricts individual header lines. An attacker can send a large number of short headers that are accumulated in memory inside DefaultStompHeadersSubframe until the JVM throws an OutOfMemoryError, causing denial of service for servers exposing a STOMP endpoint based on StompSubframeDecoder. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

• CWE-400
• CWE-770

• https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003bPatch
• https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6Patch
• https://github.com/netty/netty/pull/17063Issue Tracking, Patch
• https://github.com/netty/netty/pull/17065Issue Tracking, Patch
• https://github.com/netty/netty/releases/tag/netty-4.1.136.FinalRelease Notes
• https://github.com/netty/netty/releases/tag/netty-4.2.16.FinalRelease Notes
• https://github.com/netty/netty/security/advisories/GHSA-vhch-2wf3-m8rpExploit, Vendor Advisory
• https://github.com/netty/netty/security/advisories/GHSA-vhch-2wf3-m8rpExploit, Vendor Advisory

Published

Jul 17, 2026

Last Modified

Jul 23, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44886Pi.Alert is a WIFI / LAN intruder detector with web service …8.7
• CVE-2026-44887Pi.Alert is a WIFI / LAN intruder detector with web service …9.8
• CVE-2026-44888Pi.Alert is a WIFI / LAN intruder detector with web service …9.8
• CVE-2026-44889WebOb provides objects for HTTP requests and responses. Prio…6.1
• CVE-2026-4489A vulnerability was detected in Tenda A18 Pro 02.03.02.28. T…8.8
• CVE-2026-44890Netty is a network application framework for development of …7.5
• CVE-2026-44892Netty is a network application framework for development of …7.5
• CVE-2026-44893Netty is a network application framework for development of …7.5
• CVE-2026-44894Netty is a network application framework for development of …7.5
• CVE-2026-44895GitLab MCP Server lets an AI agent talk directly to GitLab. …9.2
• CVE-2026-44896Mistune is a Python Markdown parser with renderers and plugi…6.1
• CVE-2026-44897Mistune is a Python Markdown parser with renderers and plugi…6.1