CVE-2026-59902Netty: Memory Exhaustion in SctpMessageCompletionHandler

Beschreibung

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with large SCTP fragments. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• https://github.com/netty/netty/security/advisories/GHSA-2qj4-mmr9-4v2f Vendor Advisory
• https://github.com/netty/netty/pull/17213 Issue TrackingPatch
• https://github.com/netty/netty/pull/17217 Issue TrackingPatch
• https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7 Patch
• https://github.com/netty/netty/releases/tag/netty-4.1.137.Final Release Notes
• https://github.com/netty/netty/releases/tag/netty-4.2.17.Final Release Notes