io.netty:netty-codec-stomp 4.2.11.Final

Direct Vulnerabilities

Known vulnerabilities in the io.netty:netty-codec-stomp package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H CRLF Injection Affected versions of this package are vulnerable to CRLF Injection via the `encodeHeaders` in the STOMP frame encoder, which fails to validate or escape newline characters in header values for certain commands. An attacker can inject arbitrary headers by including newline characters in user-controlled input, potentially bypassing authentication or modifying connection parameters. Note: This is only exploitable if user-controlled input is placed into header values of a CONNECT or CONNECTED frame, the application does not perform its own newline sanitization, and the downstream STOMP broker processes the injected headers. How to fix CRLF Injection? Upgrade `io.netty:netty-codec-stomp` to version 4.1.136.Final, 4.2.16.Final or higher.	[,4.1.136.Final)[4.2.0.Final,4.2.16.Final)
H Allocation of Resources Without Limits or Throttling Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the `StompSubframeDecoder` process. An attacker can exhaust system memory and cause a server crash by sending a large number of short headers in a single STOMP frame, resulting in an OutOfMemoryError. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `io.netty:netty-codec-stomp` to version 4.1.136.Final, 4.2.16.Final or higher.	[,4.1.136.Final)[4.2.0.Alpha1,4.2.16.Final)

Vulnerability

Vulnerable Version

CRLF Injection

Affected versions of this package are vulnerable to CRLF Injection via the encodeHeaders in the STOMP frame encoder, which fails to validate or escape newline characters in header values for certain commands. An attacker can inject arbitrary headers by including newline characters in user-controlled input, potentially bypassing authentication or modifying connection parameters.

Note: This is only exploitable if user-controlled input is placed into header values of a CONNECT or CONNECTED frame, the application does not perform its own newline sanitization, and the downstream STOMP broker processes the injected headers.

How to fix CRLF Injection?

Upgrade io.netty:netty-codec-stomp to version 4.1.136.Final, 4.2.16.Final or higher.

[,4.1.136.Final)[4.2.0.Final,4.2.16.Final)

Allocation of Resources Without Limits or Throttling

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the StompSubframeDecoder process. An attacker can exhaust system memory and cause a server crash by sending a large number of short headers in a single STOMP frame, resulting in an OutOfMemoryError.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade io.netty:netty-codec-stomp to version 4.1.136.Final, 4.2.16.Final or higher.

[,4.1.136.Final)[4.2.0.Alpha1,4.2.16.Final)

io.netty:netty-codec-stomp@4.2.11.Final

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically