The vulnerability in Netty's STOMP codec arises from a ByteBuf memory leak in the StompSubframeDecoder. When a frame's content-length is fully read, the decoder allocates a buffer and waits for a terminating NUL byte. If this byte is never received, the buffer is never released because the error handling path does not catch the replay Signal (which extends Error, not Exception), and the decoder does not release the buffer on channel teardown. A remote attacker can exploit this by sending a complete frame body without the terminating NUL byte, causing one buffer to leak per connection. With the default pooled allocator, leaked memory is not reclaimed, leading to potential memory exhaustion over time. The vulnerability affects versions up to 4.1.137.Final and 4.2.0.Final through 4.2.17.Final and is fixed in 4.1.138.Final and 4.2.18.Final.

This vulnerability can cause a denial of service through memory exhaustion as leaked buffers accumulate over the lifetime of the process. It does not impact confidentiality or integrity but can disrupt availability by exhausting memory resources on the affected system.

A fix is available in Netty versions 4.1.138.Final and 4.2.18.Final. Users should upgrade to these or later versions to remediate the vulnerability. No alternative mitigations are indicated in the advisory.