CVE-2026-59902Netty: Memory Exhaustion in SctpMessageCompletionHandler

Description

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with large SCTP fragments. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

References and patches

• https://github.com/netty/netty/security/advisories/GHSA-2qj4-mmr9-4v2f Vendor Advisory
• https://github.com/netty/netty/pull/17213 Issue TrackingPatch
• https://github.com/netty/netty/pull/17217 Issue TrackingPatch
• https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7 Patch
• https://github.com/netty/netty/releases/tag/netty-4.1.137.Final Release Notes
• https://github.com/netty/netty/releases/tag/netty-4.2.17.Final Release Notes