CVE-2026-59902: Netty: Memory Exhaustion in SctpMessageCompletionHandler

Published Aug 17, 2026
·
Updated

Summary SctpMessageCompletionHandler does not limit the total size of buffered fragments, allowing an unauthenticated attacker to cause an OutOfMemoryError by sending large SCTP fragments.

Details io.netty.handler.codec.sctp.SctpMessageCompletionHandler buffers fragments for incomplete SCTP messages. The fix for CVE-2026-46340 fixed unbounded memory growth by introducing limits on the number of concurrent incomplete messages (maxIncompleteSctpMessages) and the number of fragments per message (maxFragments).

While the count of fragments is now bounded, the handler still does not enforce a maximum size in bytes.

With the default limits of 128 messages and 128 fragments, and a typical max SCTP chunk size of 64KB, an attacker can consume up to ~1GB per connection. By opening a small number of concurrent connections, an attacker can easily exhaust the server's memory, causing an OutOfMemoryError.

Impact Memory Exhaustion. Any application using Netty's SCTP transport with SctpMessageCompletionHandler is impacted.

Other sources

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with large SCTP fragments. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.

MITRE

Affected Software

2 affected componentsFixes available
maven/io.netty:netty-transport-sctp<=4.1.136.Final
4.1.137.Final
maven/io.netty:netty-transport-sctp>=4.2.0.Final<=4.2.16.Final
4.2.17.Final

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade maven/io.netty:netty-transport-sctp to a version that resolves this vulnerability.

    Fixed in 4.1.137.Final
  2. Upgrade

    Upgrade maven/io.netty:netty-transport-sctp to a version that resolves this vulnerability.

    Fixed in 4.2.17.Final
  3. Upgrade

    Upgrade io.netty.handler.codec.sctp.SctpMessageCompletionHandler (Netty) to a version that resolves this vulnerability.

    Fixed in 4.1.137.Final
  4. Upgrade

    Upgrade io.netty.handler.codec.sctp.SctpMessageCompletionHandler (Netty) to a version that resolves this vulnerability.

    Fixed in 4.2.17.Final

Event History

Aug 17, 2026
CVE Published
via MITRE·05:48 PM
Data Sourced
via MITRE·05:48 PM
DescriptionSeverityWeakness
Advisory Published
via GitHub·05:50 PM
Data Sourced
via GitHub·05:50 PM
DescriptionSeverityWeaknessAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-59902?

The severity of CVE-2026-59902 is rated as high with a score of 7.5.

2

How do I fix CVE-2026-59902?

To fix CVE-2026-59902, it is recommended to update to the latest version of Netty that addresses this vulnerability.

3

What application is affected by CVE-2026-59902?

CVE-2026-59902 affects the Netty framework specifically in the SctpMessageCompletionHandler component.

4

What does CVE-2026-59902 allow an attacker to do?

CVE-2026-59902 allows an unauthenticated attacker to cause an OutOfMemoryError by sending large SCTP fragments.

5

Is CVE-2026-59902 an authenticated vulnerability?

No, CVE-2026-59902 is an unauthenticated vulnerability that can be exploited without credentials.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203