CVE-2026-46340: Netty: SCTP reassembly nests buffers without bound
For each non-complete SctpMessage fragment the handler does fragments.put(streamId, Unpooled.wrappedBuffer(frag, byteBuf)), wrapping the previous accumulator and the new slice into a new CompositeByteBuf every time. After N fragments the accumulator is an N-deep chain of composites, each holding references and component arrays; readableBytes()/getBytes() on the final buffer recurse N levels. There is no limit on N, on total bytes, or on the number of streamIdentifiers an attacker can open (each gets its own map entry). A peer that never sets the complete flag can grow this structure indefinitely from tiny 1-byte DATA chunks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/io.netty:netty-transport-sctpto a version that resolves this vulnerability.Fixed in 4.1.135.Final - Upgrade
Upgrade
maven/io.netty:netty-transport-sctpto a version that resolves this vulnerability.Fixed in 4.2.15.Final - Upgrade
Upgrade
netty-transport-sctpto a version that resolves this vulnerability.Fixed in 4.1.135.Final - Upgrade
Upgrade
netty-transport-sctpto a version that resolves this vulnerability.Fixed in 4.2.15.Final
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46340?
The severity of CVE-2026-46340 is classified as high, with a score of 7.5.
How do I fix CVE-2026-46340?
To fix CVE-2026-46340, upgrade to Netty 4.1.135 or later, or 4.2.15 or later.
What impact does CVE-2026-46340 have on my application?
CVE-2026-46340 can lead to a denial of service due to resource exhaustion from excessive composite buffers.
Is CVE-2026-46340 a vulnerability in all versions of Netty?
CVE-2026-46340 affects versions of Netty prior to 4.1.135 and 4.2.15.
How can I identify if CVE-2026-46340 is affecting my system?
To identify if CVE-2026-46340 is affecting your system, check your version of Netty and review any error logs for signs of resource exhaustion.