CVE-2026-59902
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
Netty before versions 4.1.137.Final and 4.2.17.Final limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with large SCTP fragments. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.
Risk Assessment
An attacker can cause memory exhaustion on the server, leading to denial of service (DoS) and potential unavailability of the application.
Recommendation
Upgrade Netty to version 4.1.137.Final or 4.2.17.Final (or later) as soon as possible.
Original NVD description (English source)
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with large SCTP fragments. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.