CVE-2026-93560 in Apache Camel
Summary
by MITRE • 09/18/2026
STOMP codec content-length long-to-int truncation causes infinite decode loop DoS
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in the STOMP codec involves a critical integer overflow condition during the parsing of message headers, specifically concerning the Content-Length field. In many implementations of the Simple Text Oriented Messaging Protocol (STOMP), header values such as content length are parsed from ASCII strings and converted into numeric types for memory allocation or buffer management operations. The specific flaw arises when a maliciously crafted STOMP frame contains a Content-Length value that exceeds the maximum limit of a signed 32-bit integer, typically resulting in a negative number due to two's complement arithmetic truncation. This long-to-int conversion error is not accompanied by adequate bounds checking before the application attempts to allocate memory or initialize buffers based on this truncated size. Consequently, the system interprets an extremely large request as having a small or even negative payload size, leading to incorrect logic flow within the decoding routine.
This integer truncation directly facilitates a Denial of Service (DoS) attack by triggering an infinite decode loop. When the application proceeds with processing the message using the truncated length value, it may enter a state where it continuously attempts to read or process data without reaching the expected termination condition defined by the flawed header size. Alternatively, if the logic relies on reading exactly that many bytes and the underlying stream behavior interacts poorly with negative or zero-length reads in certain library implementations, the loop control variables fail to advance correctly. This results in the CPU being consumed indefinitely as the codec spins within its parsing function, unable to return control to the main application thread. The impact is severe for any service relying on this STOMP implementation, as a single malicious packet can exhaust system resources and render the messaging broker or client unavailable to legitimate users.
From a classification perspective, this vulnerability aligns with CWE-190 Integer Overflow or Wraparound, which describes situations where an arithmetic operation results in a value that exceeds the maximum limit of the data type used to store it. Furthermore, because the exploitation leads to resource exhaustion and service unavailability without requiring authentication, it maps directly to MITRE ATT&CK technique T1496 Resource Hijacking under the sub-technique of Denial of Service via infinite loops or CPU consumption. Attackers can leverage this flaw remotely if the STOMP endpoint is exposed over a network, making it particularly dangerous in cloud-native environments where messaging brokers are critical infrastructure components. The lack of input validation on numeric header fields represents a fundamental failure in secure coding practices regarding type safety and boundary checks.
Mitigation strategies must focus on rigorous input validation at the point of parsing. Developers should implement explicit range checking for all integer-based headers before performing any arithmetic operations or memory allocations. Specifically, the Content-Length value should be validated to ensure it falls within an acceptable positive range that is well below system limits, such as a few megabytes depending on application requirements. Additionally, employing static analysis tools configured to detect integer overflow patterns can help identify similar vulnerabilities in other parts of the codebase. For immediate remediation, applying patches provided by the library maintainers is essential, and if patching is not immediately feasible, deploying a Web Application Firewall (WAF) or reverse proxy rule that inspects STOMP frames for excessively large header values can provide an effective defense-in-depth layer to block malicious payloads before they reach the vulnerable codec.