CVE-2026-44891: netty Uncontrolled Resource Consumption
Vulnerability summary
CVE-2026-44891 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in netty. EPSS estimates a 0.73% chance of exploitation in the next 30 days, higher than 53.2% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 2 · Related 3Timeline
- 17-07-2026PublishedVulnerability first disclosed.
- 20-07-2026Last modifiedVulnerability information updated.
Description
Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, and the maxLineLength parameter only restricts individual header lines. An attacker can send a large number of short headers that are accumulated in memory inside DefaultStompHeadersSubframe until the JVM throws an OutOfMemoryError, causing denial of service for servers exposing a STOMP endpoint based on StompSubframeDecoder. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · MavenEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.73%
Chance of exploitation in the next 30 days
Percentile
53%
Versus all other CVEs
30-day change
+0.30 pp
From 0.42% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundNetty
Maturity: poc
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Affected systems
Chainguard29 products
- apache-hop< 2.18.1-r5
- apache-hop-fips< 2.18.1-r4
- celeborn-0.5< 0.5.4-r29
- celeborn-0.6< 0.6.3-r10
- gremlin-server< 3.8.1-r2
Wolfi16 products
- celeborn-0.6< 0.6.3-r10
- management-api-for-apache-cassandra-5.0< 0.1.122-r2
- tez< 0.10.5-r20
- thingsboard-tb-mqtt-transport< 4.3.1.3-r4
- thingsboard-tb-node< 4.3.1.3-r4
Debian1 product
- nettyAll versions (No fix recorded)
Io.netty1 product
- netty-codec-stomp≥ 4.2.0.Alpha1, < 4.2.16.Final | < 4.1.136.Final
Netty1 product
- netty< 4.1.136.Final | ≥ 4.2.0.Final, < 4.2.16.Final | < 4.1.136 | ≥ 4.2.0, < 4.2.16
Ubuntu1 product
- nettyAll versions (No fix recorded)
6 vendors · 49 products
References
13 links- github.com/netty/netty/security/advisories/GHSA-vhch-2wf3-m8rpX Refsource CONFIRMREPORTAdvisoryWEBExploitVendor Advisory
- github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003bX Refsource MISCREPORTFIXPatch
- github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6X Refsource MISCREPORTFIXPatch
Show all 13 references
- github.com/netty/nettyPACKAGE