CVE-2026-59902

Published: Aug 17, 2026Modified: Sep 10, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with large SCTP fragments. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.

Related CWEs

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

References (6)

https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7

Source: security-advisories@github.com

https://github.com/netty/netty/pull/17213

Source: security-advisories@github.com

https://github.com/netty/netty/pull/17217

Source: security-advisories@github.com

https://github.com/netty/netty/releases/tag/netty-4.1.137.Final

Source: security-advisories@github.com

https://github.com/netty/netty/releases/tag/netty-4.2.17.Final

Source: security-advisories@github.com

https://github.com/netty/netty/security/advisories/GHSA-2qj4-mmr9-4v2f

Source: security-advisories@github.com

Timeline

No history available yet.