CVE-2026-59902CWE-400denial-of-service

CVE-2026-59902

High · published August 17, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
29.2
In the wild
Unconfirmed
What it is

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with large SCTP fragments. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00365 · 29.2th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2026-08-17T22:17Z
Affected products (2)
ProductVersionsFixed in
netty/netty< 4.1.1374.1.137
netty/netty≥ 4.2.0, < 4.2.174.2.17
References (6)
https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7 · [email protected]https://github.com/netty/netty/pull/17213 · [email protected]https://github.com/netty/netty/pull/17217 · [email protected]https://github.com/netty/netty/releases/tag/netty-4.1.137.Final · [email protected]https://github.com/netty/netty/releases/tag/netty-4.2.17.Final · [email protected]https://github.com/netty/netty/security/advisories/GHSA-2qj4-mmr9-4v2f · [email protected]
EPSS history
Timeline
  • 17 AUG 17:48Z
    Netty: Memory Exhaustion in SctpMessageCompletionHandler
    cvelistv5