CVE-2026-93560 describes an integer truncation vulnerability in the Netty STOMP codec where a remote attacker can send a STOMP frame with a content-length header larger than the maximum integer value. This triggers an infinite decode loop, causing resource exhaustion and a Denial of Service condition. The vulnerability affects multiple explicitly listed Netty versions. There is no information about available patches or vendor advisories in the provided data.

The vulnerability can be exploited remotely without privileges or user interaction to cause a Denial of Service by exhausting system memory and CPU resources due to an infinite decode loop in the STOMP codec. There is no indication of confidentiality or integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider limiting exposure of the STOMP service to untrusted networks or applying network-level protections to mitigate potential DoS attempts.