Detections
Analytics

SCA: security update for io.netty:netty-codec-stomp (GHSA-vhch-2wf3-m8rp)

high Tenable Cloud Security Plugin ID 444708

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Netty is a network application framework for development of protocol servers and clients. Prior to
 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the total
 number of headers or their cumulative size per frame, and the maxLineLength parameter only restricts
 individual header lines. An attacker can send a large number of short headers that are accumulated in
 memory inside DefaultStompHeadersSubframe until the JVM throws an OutOfMemoryError, causing denial of
 service for servers exposing a STOMP endpoint based on StompSubframeDecoder. This issue is fixed in
 versions 4.1.136.Final and 4.2.16.Final. (CVE-2026-44891)

Solution

Update the io.netty:netty-codec-stomp library and its related packages to version 4.1.136.Final or later.

See Also

https://github.com/advisories/GHSA-vhch-2wf3-m8rp

Plugin Details

Severity: High

ID: 444708

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 7/15/2026

Updated: 7/23/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.74

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-44891

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 7/14/2026

Vulnerability Publication Date: 7/14/2026

Reference Information

CVE: CVE-2026-44891