GHSA-2qj4-mmr9-4v2f: High severity maven/io.netty:netty-transport-sctp vulnerability
Summary SctpMessageCompletionHandler does not limit the total size of buffered fragments, allowing an unauthenticated attacker to cause an OutOfMemoryError by sending large SCTP fragments.
Details io.netty.handler.codec.sctp.SctpMessageCompletionHandler buffers fragments for incomplete SCTP messages. The fix for CVE-2026-46340 fixed unbounded memory growth by introducing limits on the number of concurrent incomplete messages (maxIncompleteSctpMessages) and the number of fragments per message (maxFragments).
While the count of fragments is now bounded, the handler still does not enforce a maximum size in bytes.
With the default limits of 128 messages and 128 fragments, and a typical max SCTP chunk size of 64KB, an attacker can consume up to ~1GB per connection. By opening a small number of concurrent connections, an attacker can easily exhaust the server's memory, causing an OutOfMemoryError.
Impact Memory Exhaustion. Any application using Netty's SCTP transport with SctpMessageCompletionHandler is impacted.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/io.netty:netty-transport-sctpto a version that resolves this vulnerability.Fixed in 4.1.137.Final - Upgrade
Upgrade
maven/io.netty:netty-transport-sctpto a version that resolves this vulnerability.Fixed in 4.2.17.Final - Upgrade
Upgrade
Netty (io.netty.handler.codec.sctp.SctpMessageCompletionHandler)to a version that resolves this vulnerability.Patch CVE-2026-46340 - Configuration
Set/keep maxIncompleteSctpMessages to a bounded value (introduced by CVE-2026-46340) to limit the number of concurrent incomplete SCTP messages buffered by SctpMessageCompletionHandler.
io.netty.handler.codec.sctp.SctpMessageCompletionHandler maxIncompleteSctpMessages = 128 (default) - Configuration
Set/keep maxFragments to a bounded value (introduced by CVE-2026-46340) to limit the number of fragments per incomplete SCTP message buffered by SctpMessageCompletionHandler.
io.netty.handler.codec.sctp.SctpMessageCompletionHandler maxFragments = 128 (default)
Event History
Frequently Asked Questions
What is the severity of GHSA-2qj4-mmr9-4v2f?
The severity of GHSA-2qj4-mmr9-4v2f is high with a score of 7.5.
What vulnerability does GHSA-2qj4-mmr9-4v2f describe?
GHSA-2qj4-mmr9-4v2f describes a vulnerability in the SctpMessageCompletionHandler that allows unauthenticated attackers to cause an OutOfMemoryError by sending large SCTP fragments.
How do I fix GHSA-2qj4-mmr9-4v2f?
To fix GHSA-2qj4-mmr9-4v2f, update to the latest version of the io.netty:netty-transport-sctp library that addresses the buffer size issue.
What is the potential impact of GHSA-2qj4-mmr9-4v2f?
The potential impact of GHSA-2qj4-mmr9-4v2f is a denial-of-service condition due to excessive memory consumption.
Who is affected by GHSA-2qj4-mmr9-4v2f?
Any application using io.netty:netty-transport-sctp without mitigating the buffer limit issue is affected by GHSA-2qj4-mmr9-4v2f.