CVE-2026-59902

HIGH 7.5

Netty: Memory Exhaustion in SctpMessageCompletionHandler

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with large SCTP fragments. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.

CWE	CWE-400
Vendor	netty
Product	netty
Published	Aug 17, 2026

Stay Ahead of the Next One

Get instant alerts for netty netty

Be the first to know when new high vulnerabilities affecting netty netty are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

netty / netty

< 4.1.137.Final >= 4.2.0.Final, < 4.2.17.Final

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/netty/netty/security/advisories/GHSA-2qj4-mmr9-4v2f github.com: https://github.com/netty/netty/pull/17213 github.com: https://github.com/netty/netty/pull/17217 github.com: https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7 github.com: https://github.com/netty/netty/releases/tag/netty-4.1.137.Final github.com: https://github.com/netty/netty/releases/tag/netty-4.2.17.Final