CVE-2026-93560: CWE-1035 in Red Hat Red Hat build of Apache Camel for Spring Boot 4
A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-length header exceeding the maximum integer value. This integer truncation vulnerability could lead to an infinite decode loop, causing a Denial of Service (DoS) by exhausting memory and CPU resources.
AI Analysis
Technical Summary
This vulnerability (CVE-2026-93560) involves a content-length long-to-int truncation in the STOMP codec implementation within the Red Hat build of Apache Camel for Spring Boot 4. The truncation leads to an infinite decode loop, resulting in a denial-of-service condition. The issue does not impact confidentiality or integrity but causes high impact on availability. The vulnerability is remotely exploitable without privileges or user interaction. The vendor advisory is available but does not specify patch or mitigation status.
Potential Impact
An attacker can remotely trigger an infinite decode loop in the STOMP codec, causing a denial of service by resource exhaustion. There is no impact on confidentiality or integrity. The service availability is severely affected, potentially leading to service outages.
Mitigation Recommendations
Patch status is not yet confirmed — check the Red Hat vendor advisory at https://access.redhat.com/security/cve/CVE-2026-93560 for current remediation guidance. No official fix or workaround is currently documented.
CVE-2026-93560: CWE-1035 in Red Hat Red Hat build of Apache Camel for Spring Boot 4
Description
A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-length header exceeding the maximum integer value. This integer truncation vulnerability could lead to an infinite decode loop, causing a Denial of Service (DoS) by exhausting memory and CPU resources.
CVSS v3.1
Score 7.5high
Affected software
Red Hat
Red Hat build of Apache Camel for Spring Boot 4
Red Hat
Red Hat Fuse 7
Red Hat
Red Hat JBoss Enterprise Application Platform 7
Red Hat
Red Hat Single Sign-On 7
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2026-93560) involves a content-length long-to-int truncation in the STOMP codec implementation within the Red Hat build of Apache Camel for Spring Boot 4. The truncation leads to an infinite decode loop, resulting in a denial-of-service condition. The issue does not impact confidentiality or integrity but causes high impact on availability. The vulnerability is remotely exploitable without privileges or user interaction. The vendor advisory is available but does not specify patch or mitigation status.
Potential Impact
An attacker can remotely trigger an infinite decode loop in the STOMP codec, causing a denial of service by resource exhaustion. There is no impact on confidentiality or integrity. The service availability is severely affected, potentially leading to service outages.
Mitigation Recommendations
Patch status is not yet confirmed — check the Red Hat vendor advisory at https://access.redhat.com/security/cve/CVE-2026-93560 for current remediation guidance. No official fix or workaround is currently documented.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-09-18T09:45:07.908Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-93560","vendor":"Red Hat"}]
Threat ID: 6aad449d55bf5e2cf517a931
Added to database: 09/18/2026, 14:03:09 UTC
Last enriched: 09/18/2026, 14:16:34 UTC
Last updated: 09/19/2026, 02:49:29 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.