CVEvulnerability
CVE-2026-59902
7.5 HIGH
Official page ↗
- Status
- Analyzed
- Published
- 2026-08-17
- Last modified
- 2026-09-23
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-400
Description
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with large SCTP fragments. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.
Affected configurations
• netty netty (< 4.1.137)
• netty netty (>= 4.2.0 < 4.2.17)
Related
Weakness · CWE (1)
- CWE-400 Uncontrolled Resource Consumption weakness
References
- https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7 Patch
- https://github.com/netty/netty/pull/17213 Issue Tracking, Patch
- https://github.com/netty/netty/pull/17217 Issue Tracking, Patch
- https://github.com/netty/netty/releases/tag/netty-4.1.137.Final Release Notes
- https://github.com/netty/netty/releases/tag/netty-4.2.17.Final Release Notes
- https://github.com/netty/netty/security/advisories/GHSA-2qj4-mmr9-4v2f Vendor Advisory