CVE-2026-100657

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-100657", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "REJECTED", "assignerShortName": "VulnCheck", "dateReserved": "2026-09-26T02:33:59.038Z", "datePublished": "2026-09-26T13:23:25.432Z", "dateUpdated": "2026-09-28T20:59:53.142Z", "dateRejected": "2026-09-28T20:59:53.142Z"}, "containers": {"cna": {"rejectedReasons": [{"lang": "en", "value": "This CVE ID has been rejected as a duplicate."}], "replacedBy": ["CVE-2026-93494"], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-28T20:59:53.142Z"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Rejected reason: This CVE ID has been rejected as a duplicate."}], "id": "CVE-2026-100657", "lastModified": "2026-09-28T22:17:30.273", "metrics": {}, "published": "2026-09-26T14:16:48.540", "references": [], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Rejected"}

{"bugzilla": {"description": "io.netty/netty-codec-stomp: netty-codec-stomp: Denial of Service via memory leak during frame decoding", "id": "2541854", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541854"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["Netty's STOMP codec (io.netty:netty-codec-stomp) contains a ByteBuf leak in StompSubframeDecoder. Once a frame's declared content-length has been fully read, the decoder allocates a chunk buffer from the channel allocator and parks it in an instance field while waiting for the single NUL byte that terminates the frame. If that byte never arrives, the buffer is never released: the replay Signal thrown by skipNullCharacter extends Error rather than Exception, so the decoder's catch(Exception) release path does not run, and StompSubframeDecoder overrides neither handlerRemoved0 nor channelInactive, so the buffer also survives channel teardown. A remote peer can leak one allocator buffer per connection by sending a complete, well-formed frame body and withholding its terminating NUL byte; with the default pooled allocator the memory is never returned to the pool or reclaimed by garbage collection, so the leak accumulates for the lifetime of the process and can lead to memory exhaustion. This affects versions up to and including 4.1.137.Final and versions 4.2.0.Final through 4.2.17.Final; it is fixed in 4.1.138.Final and 4.2.18.Final.", "A flaw was found in the Netty STOMP codec. A remote attacker can trigger a memory leak by sending a complete frame body while withholding the terminating null byte, which prevents the allocated buffer from being released even after the connection is closed. Over time, repeated connections can cause continuous memory consumption, ultimately leading to a Denial of Service (DoS) due to memory exhaustion."], "name": "CVE-2026-100657", "package_state": [{"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Affected", "package_name": "netty-codec-stomp", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Affected", "package_name": "netty-codec-stomp", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Will not fix", "package_name": "jboss-eap-7/eap74-els-openjdk11-openshift-rhel8", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Will not fix", "package_name": "jboss-eap-7/eap74-els-openjdk17-openshift-rhel8", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Will not fix", "package_name": "jboss-eap-7/eap74-els-openjdk8-openshift-rhel8", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Will not fix", "package_name": "netty-codec-stomp", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:red_hat_single_sign_on:7", "fix_state": "Affected", "package_name": "netty-codec-stomp", "product_name": "Red Hat Single Sign-On 7"}], "public_date": "2026-09-26T13:23:25Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-100657\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-100657\nhttps://github.com/netty/netty/security/advisories/GHSA-ghg5-c4jg-8q5j\nhttps://www.vulncheck.com/advisories/netty-before-4.1.138-final-bytebuf-leak-in-stompsubframedecoder"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,4.1.138.Final)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "4.1.138.Final"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.2.0.Final,4.2.18.Final)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "4.2.18.Final"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "netty", "vendor": "netty"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,4.1.138.Final)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "4.1.138.Final"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "netty", "source": "cna", "vendor": "netty"}, "product": "netty", "vendor": "netty"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.2.0.Final,4.2.18.Final)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "4.2.18.Final"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "netty", "source": "cna", "vendor": "netty"}, "product": "netty", "vendor": "netty"}], "created": "2026-09-26T15:45:13.864093+00:00", "updated": "2026-09-26T16:30:07.809482+00:00", "vendors": ["netty", "netty$PRODUCT$netty"]}