Skip to content
VulniPulse
Sign in
Highest advisory severityHigh 1 vendor · 1 advisory

CVE-2026-44891

CVE-2026-44891: 1 tracked advisory record across Red Hat. Compare source-reported impact, fixes and remediation.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Vendor advisory comparison

Red Hat

1 advisory
  • Advisory severityHigh7.5

    High [CVE-2026-44891] Denial of Service vulnerability in STOMP decoder

    CVE-2026-44891Source published Source updated

    Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp. StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, and the maxLineLength parameter only restricts individual header lines. An attacker can send a large number of short headers that are accumulated in memory inside DefaultStompHeadersSubframe until the JVM throws an OutOfMemoryError, causing denial of service for servers exposing a STOMP endpoint based on StompSubframeDecoder. A flaw was found in Netty, a network application framework, specifically within the StompSubframeDecoder component. This vulnerability allows a remote attacker to cause a denial of service (DoS) by sending a…

    Affected products in this advisory
    • Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16
    • Red Hat Data Grid 8
    • Red Hat JBoss Enterprise Application Platform 7
    • Red Hat Single Sign-On 7
    Source-reported affected versions
    • < 4.1.136.Final
    • < 4.2.16.Final
    Source-reported fixed versions
    • 4.1.136
    • 4.2.16
    • netty-codec-stomp
    • RHSA-2026:54622
    Mitigation guidance
    • To reduce the risk of this denial of service, restrict network access to any services that expose a STOMP endpoint and use Netty's `StompSubframeDecoder`. Implement firewall rules or network access controls to permit connections only from trusted sources. This action limits the ability of untrusted remote clients to exploit the vulnerability.
    Full advisory and evidenceOpen source bulletin

Android app · Google Play

Monitor future Red Hat CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features