CVE-2026-44891: Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder

July 14, 2026

The StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, allowing an attacker to cause an OutOfMemoryError, leading to a Denial of Service.

References

github.com/advisories/GHSA-vhch-2wf3-m8rp
github.com/netty/netty/security/advisories/GHSA-vhch-2wf3-m8rp
nvd.nist.gov/vuln/detail/CVE-2026-44891

Code Behaviors & Features

Detect and mitigate CVE-2026-44891 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →