CVE-2026-59902

Published: Aug 17, 2026Modified: Sep 23, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with large SCTP fragments. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.

Affected (2)

Products: Netty: Netty

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Netty Netty	version < 4.1.137
Netty Netty	4.2.0 ≤ version < 4.2.17

Related CWEs

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

References (6)

https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7

Source: security-advisories@github.com

Patch

https://github.com/netty/netty/pull/17213

Source: security-advisories@github.com

Issue TrackingPatch

https://github.com/netty/netty/pull/17217

Source: security-advisories@github.com

Issue TrackingPatch

https://github.com/netty/netty/releases/tag/netty-4.1.137.Final

Source: security-advisories@github.com

Release Notes

https://github.com/netty/netty/releases/tag/netty-4.2.17.Final

Source: security-advisories@github.com

Release Notes

https://github.com/netty/netty/security/advisories/GHSA-2qj4-mmr9-4v2f

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.