CVE-2026-93494

Executive Summary

CVE-2026-93494 is a memory exhaustion vulnerability in Netty's StompSubframeDecoder component, where a remote attacker can trigger a permanent memory leak by sending a specially crafted STOMP frame body that lacks its terminating null byte. Applications using Netty's STOMP codec to handle untrusted STOMP traffic are affected, and sustained exploitation leads to uncontrolled memory consumption and eventual Denial of Service (DoS). With a CVSS score of 7.5 (High) and no available patch, public PoC, or KEV listing, this represents a remotely exploitable availability risk that requires mitigation through network controls and monitoring.

Technical Analysis

Netty is a widely deployed asynchronous event-driven network application framework for Java, and its STOMP (Simple Text Oriented Messaging Protocol) codec is used to decode STOMP frames exchanged between clients and message brokers or custom STOMP-speaking services. The vulnerable component is the StompSubframeDecoder, which is responsible for parsing inbound STOMP frames.

According to the NVD description, the flaw manifests when an attacker sends "a specially crafted STOMP frame body without its terminating null byte." In valid STOMP framing, a frame body is terminated by a NULL octet (\x00, the null byte). The decoder relies on that terminator to know when a frame body is complete. When the terminator is absent, the decoder allocates a ByteBuf (Netty's byte buffer abstraction for reading and writing data) that "is never released." Because the buffer is not freed, it becomes a permanent memory leak: each such malformed frame accumulates an additional unreleased buffer in the Java heap (or, if direct buffers are used, in native memory).

The root cause class is improper resource management/lifetime handling in a protocol decoder — a buffer is allocated to hold incoming frame data but is not released when the frame fails to complete as expected. This maps to the assigned CWE-1035 (a weakness category) and, functionally, the memory-leak-under-unterminated-input pattern.

The attack surface is any network-exposed service or broker endpoint that accepts STOMP frames and processes them through Netty's StompSubframeDecoder. Because the trigger is a normal-looking STOMP frame whose body simply never terminates, the malformed input can originate from an unauthenticated remote peer depending on how the surrounding application handles connection establishment. No authentication, user interaction, or specialized local access is required (PR:N, UI:N in the vector).

Notably, the "permanent" nature of the leak is significant: the buffer is not reclaimed even after the offending connection closes, so resource accumulation persists beyond the individual attack session. Repeated delivery of unterminated frame bodies steadily grows the process footprint until the JVM exhausts available memory, at which point the application degrades or crashes.

Insufficient technical detail is available in the provided data regarding the exact line of code, the precise ReferenceCountUtil/release() call that is missing, or which Netty versions are affected. Affected version ranges were not supplied, and no patch, advisory, or fix commit is referenced from any tracked source.

Exploitation Scenarios

No public proof-of-concept exists for this CVE; the attack chain below is inferred strictly from the vulnerability class (unreleased buffer on malformed frame) and the NVD description.

1. Reconnaissance / target identification: An attacker identifies a reachable service that speaks STOMP and is built on Netty (for example, a message broker or application exposing a STOMP endpoint, commonly associated with messaging ports such as 61613). Version fingerprinting and banner/behavior probing can help confirm the presence of a STOMP codec, though the provided data does not specify a version-detection method.

2. Triggering the flaw: The attacker opens a connection and sends a STOMP frame whose body is crafted to omit the terminating null byte. Because the decoder expects the NULL octet to delimit the body, the frame never completes normally, and — per the description — the decoder allocates a ByteBuf that is never released.

3. Payload / execution method: At the vulnerability-class level, the payload is a protocol-conformant-looking STOMP frame minus its body terminator. No code execution, file write, or authentication is involved; the "payload" is purely the malformed frame content that induces the leak. The attacker need not exploit a parsing logic error beyond the missing terminator — the resource-management defect does the rest.

4. Post-exploitation impact: Each malformed frame (or each connection carrying one) leaks buffer memory that is never reclaimed. By repeating the request, alone or across multiple connections, the attacker drives sustained, uncontrolled memory consumption. Over time the host JVM exhausts heap (or native memory), causing application slowdown, garbage-collection thrashing, out-of-memory errors, and ultimately Denial of Service for all users of the affected STOMP service. There is no confidentiality or integrity impact (C:N/I:N); the effect is availability-only.

Impact Assessment

The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H — base score 7.5 (High). Interpreting the subscores:

• Attack Vector (Network, AV:N): Exploitable remotely over the network; the attacker does not need local access.
• Attack Complexity (Low, AC:L): No special conditions or race windows are required; sending a frame without its null terminator is trivial to automate.
• Privileges Required (None, PR:N): Depending on endpoint exposure, no authentication is needed to reach the decoder.
• User Interaction (None, UI:N): The victim does not need to click or act; the vulnerable code processes data automatically.
• Scope (Unchanged, S:U): The impact is confined to the vulnerable component's own security context.
• Confidentiality (None, C:N) / Integrity (None, I:N): No direct data exposure or tampering.
• Availability (High, A:H): The permanent leak and resulting memory exhaustion can fully deny service to the affected application.

Business impact: any enterprise application, message broker, or integration gateway that uses Netty's STOMP codec and exposes its STOMP listener to untrusted or semi-trusted networks is at risk of availability loss. Because the leak is permanent per malformed frame, a low-volume, low-skill attacker can degrade or crash a service without being blocked by typical input-validation signatures. Blast radius is the single affected process/JVM host; in horizontally scaled messaging tiers, a persistent attacker can drain capacity across instances if the trigger is broadly replayable. Unpatched status (0/4 patch confidence) means defenders cannot rely on a vendor fix and must compensate with network controls.

Detection Guidance

The detection below focuses on the observable behavior of the flaw class: anomalous STOMP framing (frames without a NULL-body terminator), repeated incomplete frame handling, and abnormal memory growth in Netty-based STOMP services. Field/parameter names used reflect the vulnerability description only; where exact protocol fields are unknown, detection operates at the stream/behavioral level.

Sigma Rule

title: Netty StompSubframeDecoder Memory Leak - Malformed STOMP Frame Without Null Terminator
id: 6f2a1c48-9349-4e0b-9c7d-1a2b3c4d5e6f
status: experimental
description: Detects application or JVM log indicators consistent with CVE-2026-93494, where STOMP frames lacking a terminating null byte cause unreleased ByteBuf allocations by Netty StompSubframeDecoder.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-93494
author: Valters IT Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1499
  - attack.impact
logsource:
  category: application
  product: java
detection:
  keywords_stomp:
    - 'StompSubframeDecoder'
    - 'STOMP'
  keywords_leak:
    - 'LEAK'
    - 'ByteBuf'
    - 'LEAK: ByteBuf.release() was not called'
    - 'not released'
    - 'unreleased'
  keywords_oom:
    - 'OutOfMemoryError'
    - 'Java heap space'
    - 'Direct buffer memory'
  selection:
    keywords_stomp|any: true
  leak_condition:
    keywords_leak|any: true
  oom_condition:
    keywords_oom|any: true
  condition: selection and (leak_condition or oom_condition)
falsepositives:
  - Application debug logs intentionally emitting STOMP parsing details
  - Legitimate Netty resource-leak warnings from unrelated codecs
level: high

YARA Rule

rule CVE_2026_93494_Netty_Stomp_Unterminated_Frame
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects STOMP frame bodies that are missing the terminating null byte, the trigger pattern for CVE-2026-93494 in Netty StompSubframeDecoder"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-93494"
        date = "2026-01-01"
        severity = "high"

    strings:
        $stomp_cmd1 = "SEND"
        $stomp_cmd2 = "SUBSCRIBE"
        $stomp_cmd3 = "MESSAGE"
        $stomp_cmd4 = "CONNECT"
        $stomp_hdr1 = "content-length:"
        $stomp_hdr2 = "destination:"
        $nul = { 00 }

    condition:
        filesize > 0 and
        ( $stomp_cmd1 or $stomp_cmd2 or $stomp_cmd3 or $stomp_cmd4 ) and
        ( $stomp_hdr1 or $stomp_hdr2 ) and
        not $nul
}

Suricata IDS Rule

alert tcp any any -> any 61613 ( \
  msg:"CVE-2026-93494 Netty StompSubframeDecoder STOMP frame without null terminator (memory leak attempt)"; \
  flow:established,to_server; \
  content:"STOMP"; nocase; \
  content:"content-length:"; nocase; \
  pcre:"/\x00$/R"; \
  nocase; \
  threshold: type both, track by_src, count 10, seconds 60; \
  classtype:attempted-dos; \
  sid:9349401; \
  rev:1; \
  reference:url,nvd.nist.gov/vuln/detail/CVE-2026-93494; \
)

Note: This signature flags repeated STOMP frames on the common STOMP port that contain a content-length header without a trailing NULL octet, which correlates with the malformed-frame pattern described in CVE-2026-93494. It is heuristic and should be tuned to reduce false positives.

Elastic Detection

sequence by process.entity_id with maxspan=5m
  [ any where event.category == "network" and network.transport == "tcp" and
      network.destination.port == 61613 and
      process.name : "java" ]
  [ any where event.category == "process" and process.name : "java" and
      ( message : "*OutOfMemoryError*" or
        message : "*Direct buffer memory*" or
        message : "*Java heap space*" ) ]

This EQL sequence looks for Java processes receiving STOMP traffic followed by out-of-memory conditions, consistent with a cumulative memory-leak DoS.

Splunk SPL Query

index=applogs (source=*netty* OR source=*stomp* OR sourcetype=java*)
("StompSubframeDecoder" OR "STOMP")
("ByteBuf.release() was not called" OR "not released" OR "unreleased" OR "LEAK")
| stats count values(message) as messages by host, process, source
| where count >= 1
| sort - count

Optional companion query for memory exhaustion signals:

index=applogs ("OutOfMemoryError" OR "Direct buffer memory" OR "Java heap space")
| stats count by host, process
| where count > 0

Wazuh OSSEC Rule

<group name="netty,stomp,cve-2026-93494,attack.t1499,">
  <rule id="934940" level="12">
    <decoded_as>json</decoded_as>
    <field name="log">StompSubframeDecoder</field>
    <field name="log">LEAK</field>
    <description>CVE-2026-93494: Netty StompSubframeDecoder unreleased ByteBuf detected - possible STOMP memory-leak exploitation</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,</group>
  </rule>

  <rule id="934941" level="13">
    <decoded_as>json</decoded_as>
    <field name="log">OutOfMemoryError</field>
    <field name="log">Direct buffer memory</field>
    <description>CVE-2026-93494: JVM out-of-memory condition consistent with Netty STOMP memory exhaustion</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source. No vendor fix, workaround, affected-version list, or advisory is available in the provided data.

1. Immediate mitigations (compensating controls):

• Restrict network exposure of STOMP endpoints using Netty's STOMP codec. Only allow trusted clients via firewall rules, security groups, or network segmentation; do not expose STOMP listeners to untrusted networks.
• Require authentication and authorization at the message broker/gateway layer so anonymous or untrusted peers cannot submit STOMP frames to the decoder.
• Apply connection and frame-rate limits, and cap the maximum memory allocated to the JVM, so a leak triggers a controlled restart rather than a host-wide outage.
• Increase monitoring for JVM memory growth and netty resource-leak warnings to detect abusive patterns early and allow proactive restart or client blocking.

2. Patch/upgrade steps:

• No patched version is published or referenced at this time. Monitor Netty's official release channels and security advisories, and the NVD entry for CVE-2026-93494, for a fixed release.
• When a fix is announced, upgrade Netty (and any dependent broker/gateway that bundles the STOMP codec) to the fixed version and verify the STOMP codec handles unterminated frame bodies by releasing the associated buffers.
• Re-test STOMP decoding paths for resource retention after upgrading.

3. Long-term hardening:

• Enforce strict input validation/limiting at the protocol boundary (reject or close connections on malformed or over-long frames).
• Add memory-pressure alarms and automated, isolated instance recycling for STOMP-handling services.
• Maintain an inventory of components that embed Netty's STOMP codec so future advisories can be triaged quickly.
• Adopt a hardware/software watch for the emerging CVE and re-evaluate patch status as evidence becomes available.

References

• NVD — CVE-2026-93494: https://nvd.nist.gov/vuln/detail/CVE-2026-93494
• Netty project (official) — monitor releases and security announcements: https://netty.io/
• Netty GitHub repository — track commits and issues referencing StompSubframeDecoder: https://github.com/netty/netty
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• CWE — reference for the assigned weakness category (CWE-1035): https://cwe.mitre.org/

Threat actor / exploit-in-the-wild status: No public PoC, no Nuclei template, no exploit code, and no CISA KEV listing were provided. There is no evidence in the supplied data of active exploitation or attributed threat actor campaigns. EPSS is not yet scored by FIRST.org; no EPSS value has been fabricated. Re-assess when patch or exploit intelligence becomes available.