Vulnerability · Published Aug 17, 2026 · Assigned by GitHub_M
CVE-2026-59902Netty: Memory Exhaustion in SctpMessageCompletionHandler
High 7.5
In plain English
A high-severity uncontrolled resource consumption in netty from netty. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with large SCTP fragments. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | netty | no fix listed | DEBIAN-CVE-2026-59902 |
| Debian:13 | netty | no fix listed | DEBIAN-CVE-2026-59902 |
| Debian:14 | netty | no fix listed | DEBIAN-CVE-2026-59902 |
| Maven | io.netty:netty-transport-sctp | 4.2.17.Final | GHSA-2qj4-mmr9-4v2f |
| Maven | io.netty:netty-transport-sctp | 4.1.137.Final | GHSA-2qj4-mmr9-4v2f |
| Ubuntu:26.10 | netty | no fix listed | UBUNTU-CVE-2026-59902 |
Affected products (as reported)
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/netty/netty/security/advisories/GHSA-2qj4-mmr9-4v2f x_refsource_CONFIRM
- https://github.com/netty/netty/pull/17213 x_refsource_MISC
- https://github.com/netty/netty/pull/17217 x_refsource_MISC
- https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7 x_refsource_MISC
- https://github.com/netty/netty/releases/tag/netty-4.1.137.Final x_refsource_MISC
- https://github.com/netty/netty/releases/tag/netty-4.2.17.Final x_refsource_MISC