CVE-2026-100657 Details

A ByteBuf leak vulnerability has been identified in Netty's STOMP codec (io.netty:netty-codec-stomp) within the StompSubframeDecoder class. This issue arises when a frame's declared content-length is fully read, but the decoder does not receive the terminating NUL byte. The decoder allocates a chunk buffer from the channel allocator and holds it in an instance field, waiting for the NUL byte to arrive. If the byte is never sent, the buffer remains unreleased, leading to a memory leak. This leak persists for the lifetime of the process, as the default pooled allocator does not return the memory to the pool or allow it to be reclaimed by garbage collection, potentially causing memory exhaustion. The vulnerability affects Netty versions through 4.1.137.Final and 4.2.0.Final through 4.2.17.Final, and is fixed in versions 4.1.138.Final and 4.2.18.Final.

Users can upgrade to Netty versions 4.1.138.Final or 4.2.18.Final, where this vulnerability has been fixed.