CVE-2026-100657

Executive Summary

CVE-2026-100657 is a remote denial-of-service vulnerability in Netty's STOMP codec (io.netty:netty-codec-stomp), specifically a ByteBuf memory leak in StompSubframeDecoder classified as CWE-772 (Missing Release of Resource after Effective Lifetime). Any application using an affected Netty version to decode STOMP frames is impacted: versions up to and including 4.1.137.Final, and 4.2.0.Final through 4.2.17.Final. A remote, unauthenticated peer can leak one allocator buffer per connection by sending a complete, well-formed frame body while withholding the terminating NUL byte; with the default pooled allocator this memory is never returned to the pool or reclaimed by garbage collection, accumulating over the process lifetime and potentially causing memory exhaustion (CVSS 7.5, Availability: High). No public PoC or exploit code is currently available, and no EPSS score has been assigned.

Technical Analysis

Netty's STOMP codec (io.netty:netty-codec-stomp) provides STOMP protocol framing over Netty channels. STOMP frames are text-oriented and consist of a command line, headers, a blank line, an optional body whose length may be declared via a content-length header, and a frame terminator consisting of a single NUL byte (\0).

The defect is a resource-lifetime bug in StompSubframeDecoder. Once a frame's declared content-length has been fully read, the decoder allocates a chunk buffer from the channel allocator and stores it in an instance field while it waits for the single NUL byte that terminates the frame. The release of this parked buffer depends on a specific code path:

1. Normal path blocked by exception hierarchy. When the terminator byte does not arrive, the skipNullCharacter logic throws a "replay" Signal. Critically, this Signal extends Error rather than Exception. The decoder's cleanup logic is implemented in a catch(Exception) block. Because Error is not a subclass of Exception, this release path is never executed — the parked buffer is not released.
2. No teardown safety net. StompSubframeDecoder overrides neither handlerRemoved0 nor channelInactive. Consequently, when the connection is closed or the handler is removed, there is no lifecycle hook that releases the parked buffer. The buffer survives channel teardown.
3. Allocator behavior amplifies impact. With Netty's default pooled allocator, the leaked chunk is never returned to the pool nor handed to garbage collection. The leak therefore accumulates for the entire lifetime of the JVM process, not merely the lifetime of the socket.

This is a memory/resource-lifetime failure rather than an injection, deserialization, or authentication flaw. There is no memory corruption, no code execution, and no confidentiality or integrity impact; the sole impact is availability degradation through unbounded heap/native memory growth.

The attack surface is any remotely reachable service that decodes STOMP traffic with an affected Netty codec — including message brokers and applications exposing STOMP listeners. Triggering requires only network reachability and the ability to send a syntactically complete STOMP frame body while omitting the trailing NUL — no authentication or user interaction, consistent with the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Insufficient technical detail is available regarding specific byte offsets, exact field names beyond content-length, and allocator tuning interactions; the analysis above reflects only what the NVD description states.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (unreleased ByteBuf / CWE-772) and the mechanics described in the NVD data.

1. Reconnaissance / target identification. An adversary identifies a service that speaks STOMP over a network socket and is backed by an affected Netty version. This is discoverable via banner/port scanning of common STOMP ports (for example, 61613) and by fingerprinting STOMP protocol responses. No credentials are required to reach the decoding path.

2. Triggering the flaw class. The attacker establishes a connection and sends a STOMP frame whose header declares a content-length, then transmits exactly that many body bytes — a complete, well-formed frame body — but deliberately withholds the terminating single NUL byte. Because the declared content-length has been fully read, StompSubframeDecoder allocates a chunk buffer from the channel allocator and parks it in an instance field awaiting the NUL.

3. Why cleanup does not occur. With the NUL absent, the skipNullCharacter replay Signal (which extends Error, not Exception) is thrown, bypassing the decoder's catch(Exception) release path. Because StompSubframeDecoder overrides neither handlerRemoved0 nor channelInactive, the buffer is not released even when the attacker closes the connection. No specific payload bytes beyond a valid frame header/body and a missing NUL are needed — the vulnerability is reached through protocol framing state, not through crafted content.

4. Post-exploitation impact. Each connection leaks one allocator buffer. An attacker repeats this across many connections, leaking one buffer per connection per attempt. Under the default pooled allocator the chunks are neither pooled back nor garbage-collected, so consumption grows monotonically with the process lifetime. Sufficient repetition drives the target toward memory exhaustion, degraded throughput, and eventual OutOfMemory conditions — a sustained remote denial of service with no authentication and no user interaction.

Impact Assessment

The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, yielding a base score of 7.5 (HIGH). The subscores map directly to the mechanism:

• AV:N (Network) — the decoder processes remotely supplied STOMP traffic.
• AC:L (Low) — no special conditions; a well-formed frame body minus the NUL terminator suffices.
• PR:N / UI:N — no privileges or user interaction required.
• S:U (Unchanged) — impact is confined to the vulnerable component.
• C:N / I:N — no confidentiality or integrity effect; this is purely a resource leak.
• A:H (High) — successful, repeated triggering can exhaust memory and cause loss of availability.

Blast radius. Any deployed service that decodes STOMP using the affected Netty codec: message brokers, integration/ESB components, and custom applications exposing STOMP listeners. Because affected versions are library-scoped (io.netty:netty-codec-stomp), the vulnerability propagates transitively into every downstream application that bundles it — the true blast radius is typically larger than any single product's CVE surface.

Business impact. Sustained memory growth leads to performance degradation, garbage-collection pressure, OOM crashes, and service unavailability for the affected endpoint and potentially the whole JVM. Combined with its low attack complexity and zero authentication requirement, this makes an attractive, low-effort DoS primitive against internet-exposed STOMP listeners.

Detection Guidance

Detection strategy centers on three signals: (1) protocol-level anomalies — STOMP frames whose declared content-length is fully delivered but whose NUL terminator never arrives; (2) connection churn in which sessions end mid-frame; and (3) host/JVM-level memory growth correlated with STOMP connection patterns.

Sigma Rule

title: Possible Netty STOMP ByteBuf Leak DoS (CVE-2026-100657)
id: 8f3c1a20-5e4d-4b9a-9c7e-stomp100657
status: experimental
description: Detects connection churn and STOMP traffic patterns consistent with the bytebuf leak in StompSubframeDecoder.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100657
logsource:
  category: application
  product: netty
detection:
  selection_memory:
    EventType: 'OutOfMemoryError'
  selection_stomp:
    message|contains:
      - 'StompSubframeDecoder'
      - 'stomp'
  timeframe: 15m
  condition: selection_stomp and selection_memory
fields:
  - src_ip
  - dest_port
  - message
level: high
tags:
  - attack.t1190
  - cve.2026-100657

YARA Rule

rule CVE_2026_100657_Netty_Stomp_Leak
{
    meta:
        description = "Detects Netty STOMP codec artifacts referencing the affected decoder/version range"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100657"
        date = "2026-01-01"
    strings:
        $decoder = "StompSubframeDecoder" ascii wide
        $pkg     = "io.netty:netty-codec-stomp" ascii wide
        $v41     = "4.1.137.Final" ascii
        $v42     = "4.2.17.Final" ascii
        $content = "content-length" ascii nocase
    condition:
        uint32(0) == 0x504B0304 or true
        and ( $decoder or $pkg )
        and ( $v41 or $v42 )
}

Suricata IDS Rule

alert tcp any any -> any 61613 (msg:"CVE-2026-100657 Netty STOMP ByteBuf Leak DoS Attempt"; flow:to_server,established; content:"content-length"; nocase; content:"|0a0a|"; distance:0; pcre:"/content-length:[^\r\n]*\r?\n[^\r\n]*\r?\n/s"; threshold:type both, track by_src, count 20, seconds 60; classtype:attempted-dos; sid:2026100657; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=2m
  [ network where network.transport == "tcp" and destination.port == 61613 ]
  [ network where network.transport == "tcp" and destination.port == 61613 and not network.bytes == 0 ]
| where event.category == "network"

Splunk SPL Query

index=network (dest_port=61613 OR stomp=*) sourcetype=suricata OR sourcetype=pan:traffic
| stats count dc(src_ip) as srcs values(src_ip) as sources by dest_ip dest_port
| where count > 50
| append
    [ search index=app sourcetype=java (message="OutOfMemoryError" OR message="StompSubframeDecoder")
      | stats count by host
      | eval alert="memory_pressure" ]

Wazuh OSSEC Rule

<group name="netty,stomp,cve-2026-100657,">
  <rule id="100657" level="12">
    <if_sid>1002</if_sid>
    <field name="dstport">61613</field>
    <description>CVE-2026-100657: STOMP activity to port 61613 - possible Netty ByteBuf leak DoS</description>
    <group>attack,denial_of_service,</group>
  </rule>
  <rule id="100658" level="12">
    <decoded_as>java</decoded_as>
    <match>OutOfMemoryError|StompSubframeDecoder</match>
    <description>CVE-2026-100657: Netty STOMP codec memory pressure indicator</description>
    <group>attack,denial_of_service,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-package mapping was supplied in the provided data.

1. Immediate mitigations. Restrict network exposure of STOMP listeners to trusted networks (network ACLs, firewall rules, or binding to loopback/management interfaces). Enforce per-source connection limits and total connection caps to bound the per-connection leak rate. Apply idle/read-timeout policies at the load balancer or reverse proxy so stalled mid-frame connections are terminated promptly, and cap inbound frame sizes. Where possible, configure the JVM/Netty allocator so leaked-but-unreferenced buffers can be reclaimed, and alert on heap/native memory growth correlated with STOMP connection counts. Note: these reduce exposure and slow the leak but do not eliminate it.

2. Patch/upgrade steps. Upgrade io.netty:netty-codec-stomp (and the parent Netty BOM/dependency chain) to 4.1.138.Final or 4.2.18.Final, the versions in which the issue is fixed per the NVD description. Update transitive/downstream dependencies and rebuild; redeploy affected services and verify the resolved codec version at runtime.

3. Long-term hardening. Track the Netty dependency continuously (SBOM + dependency scanning) so transitive copies of the STOMP codec are visible. Add regression tests that exercise incomplete-frame and missing-NUL scenarios. Monitor upstream Netty release notes for the corresponding fix and watch for any update to this record's patch-confidence signal. Maintain rate limiting and resource budgets for all network-facing decoders.

References

• NVD — CVE-2026-100657: https://nvd.nist.gov/vuln/detail/CVE-2026-100657
• CWE-772 — Missing Release of Resource after Effective Lifetime: https://cwe.mitre.org/data/definitions/772.html
• Netty Project (vendor) — release notes for 4.1.138.Final and 4.2.18.Final: https://github.com/netty/netty/releases
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST EPSS (no score currently assigned): https://www.first.org/epss/

No threat actor campaigns or exploit-in-the-wild activity are known for this CVE at the time of writing; it is not listed in CISA KEV, and no public PoC or exploit code has been observed.