CVE-2026-59902
CVE-2026-59902 · Netty: Memory Exhaustion in SctpMessageCompletionHandler
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with large SCTP fragments. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.
CVSS 7.5 · High · EPSS 0.4%
- Published
- Updated
Stack: system
Affected products and versions
netty
- Versions
- < 4.1.137.Final: Affected
- >= 4.2.0.Final, < 4.2.17.Final: Affected
No fix published
netty Debian:12
- Versions
- 1:4.1.48-10
- 1:4.1.48-11
- 1:4.1.48-12
- 1:4.1.48-13
- 1:4.1.48-14
- 1:4.1.48-15
- 1:4.1.48-16
- 1:4.1.48-7
- 1:4.1.48-7+deb12u1
- 1:4.1.48-7+deb12u2
- 1:4.1.48-8
- 1:4.1.48-9
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
netty Debian:13
- Versions
- 1:4.1.48-10
- 1:4.1.48-10+deb13u1
- 1:4.1.48-11
- 1:4.1.48-12
- 1:4.1.48-13
- 1:4.1.48-14
- 1:4.1.48-15
- 1:4.1.48-16
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
netty Debian:14
- Versions
- 1:4.1.48-10
- 1:4.1.48-11
- 1:4.1.48-12
- 1:4.1.48-13
- 1:4.1.48-14
- 1:4.1.48-15
- 1:4.1.48-16
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
netty Ubuntu:Pro:14.04:LTS
- Versions
- 1:3.2.6.Final-2
- 1:3.2.6.Final-2+deb8u2build0.14.04.1~esm1
- 1:3.2.6.Final-2+deb8u2ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
netty Ubuntu:Pro:16.04:LTS
- Versions
- 1:3.2.6.Final-2
- 1:4.0.32-1
- 1:4.0.33-1
- 1:4.0.34-1
- 1:4.0.34-1ubuntu0.1~esm1
- 1:4.0.34-1ubuntu0.1~esm2
- 1:4.0.34-1ubuntu0.1~esm3
- 1:4.0.34-1ubuntu0.1~esm4
- 1:4.0.34-1ubuntu0.1~esm5
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
netty Ubuntu:Pro:18.04:LTS
- Versions
- 1:4.1.7-4
- 1:4.1.7-4ubuntu0.1~esm1
- 1:4.1.7-4ubuntu0.1
- 1:4.1.7-4ubuntu0.1+esm1
- 1:4.1.7-4ubuntu0.1+esm2
- 1:4.1.7-4ubuntu0.1+esm3
- 1:4.1.7-4ubuntu0.1+esm4
- 1:4.1.7-4ubuntu0.1+esm5
- 1:4.1.7-4ubuntu0.1+esm6
- 1:4.1.7-4ubuntu0.1+esm7
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
netty Ubuntu:Pro:20.04:LTS
- Versions
- 1:4.1.33-1
- 1:4.1.33-2
- 1:4.1.33-3
- 1:4.1.45-1
- 1:4.1.45-1ubuntu0.1~esm1
- 1:4.1.45-1ubuntu0.1~esm2
- 1:4.1.45-1ubuntu0.1~esm3
- 1:4.1.45-1ubuntu0.1~esm4
- 1:4.1.45-1ubuntu0.1~esm6
- 1:4.1.45-1ubuntu0.1~esm7
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
netty Ubuntu:Pro:22.04:LTS
- Versions
- 1:4.1.48-4
- 1:4.1.48-4+deb11u1build0.22.04.1
- 1:4.1.48-4+deb11u2build0.22.04.1
- 1:4.1.48-4+deb11u2ubuntu0.1~esm1
- 1:4.1.48-4+deb11u2ubuntu0.1~esm2
- 1:4.1.48-4+deb11u2ubuntu0.1
- 1:4.1.48-4+deb11u2ubuntu0.1+esm1
- 1:4.1.48-4+deb11u2ubuntu0.1+esm3
- 1:4.1.48-4+deb11u2ubuntu0.2
- 1:4.1.48-4+deb11u2ubuntu0.2+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
netty Ubuntu:Pro:24.04:LTS
- Versions
- 1:4.1.48-7
- 1:4.1.48-8
- 1:4.1.48-9
- 1:4.1.48-9ubuntu0.1~esm1
- 1:4.1.48-9ubuntu0.1~esm2
- 1:4.1.48-9ubuntu0.1
- 1:4.1.48-9ubuntu0.1+esm1
- 1:4.1.48-9ubuntu0.1+esm3
- 1:4.1.48-9ubuntu0.2
- 1:4.1.48-9ubuntu0.2+esm1
- 1:4.1.48-9ubuntu0.2+esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
netty Ubuntu:26.10
- Versions
- 1:4.1.48-16
- 1:4.1.48-16ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
netty Ubuntu:Pro:26.04:LTS
- Versions
- 1:4.1.48-10
- 1:4.1.48-11
- 1:4.1.48-12
- 1:4.1.48-13
- 1:4.1.48-14
- 1:4.1.48-16
- 1:4.1.48-16ubuntu0.1~esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://github.com/netty/netty/security/advisories/GHSA-2qj4-mmr9-4v2f
- https://github.com/netty/netty/pull/17213
- https://github.com/netty/netty/pull/17217
- https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7
- https://github.com/netty/netty/releases/tag/netty-4.1.137.Final
- https://github.com/netty/netty/releases/tag/netty-4.2.17.Final
- https://nvd.nist.gov/vuln/detail/CVE-2026-59902