CVE-2026-59902: Netty: Memory Exhaustion in SctpMessageCompletionHandler
Summary SctpMessageCompletionHandler does not limit the total size of buffered fragments, allowing an unauthenticated attacker to cause an OutOfMemoryError by sending large SCTP fragments.
Details io.netty.handler.codec.sctp.SctpMessageCompletionHandler buffers fragments for incomplete SCTP messages. The fix for CVE-2026-46340 fixed unbounded memory growth by introducing limits on the number of concurrent incomplete messages (maxIncompleteSctpMessages) and the number of fragments per message (maxFragments).
While the count of fragments is now bounded, the handler still does not enforce a maximum size in bytes.
With the default limits of 128 messages and 128 fragments, and a typical max SCTP chunk size of 64KB, an attacker can consume up to ~1GB per connection. By opening a small number of concurrent connections, an attacker can easily exhaust the server's memory, causing an OutOfMemoryError.
Impact Memory Exhaustion. Any application using Netty's SCTP transport with SctpMessageCompletionHandler is impacted.
Other sources
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with large SCTP fragments. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/io.netty:netty-transport-sctpto a version that resolves this vulnerability.Fixed in 4.1.137.Final - Upgrade
Upgrade
maven/io.netty:netty-transport-sctpto a version that resolves this vulnerability.Fixed in 4.2.17.Final - Upgrade
Upgrade
io.netty.handler.codec.sctp.SctpMessageCompletionHandler (Netty)to a version that resolves this vulnerability.Fixed in 4.1.137.Final - Upgrade
Upgrade
io.netty.handler.codec.sctp.SctpMessageCompletionHandler (Netty)to a version that resolves this vulnerability.Fixed in 4.2.17.Final
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59902?
The severity of CVE-2026-59902 is rated as high with a score of 7.5.
How do I fix CVE-2026-59902?
To fix CVE-2026-59902, it is recommended to update to the latest version of Netty that addresses this vulnerability.
What application is affected by CVE-2026-59902?
CVE-2026-59902 affects the Netty framework specifically in the SctpMessageCompletionHandler component.
What does CVE-2026-59902 allow an attacker to do?
CVE-2026-59902 allows an unauthenticated attacker to cause an OutOfMemoryError by sending large SCTP fragments.
Is CVE-2026-59902 an authenticated vulnerability?
No, CVE-2026-59902 is an unauthenticated vulnerability that can be exploited without credentials.