Vulnerabilities CVE-2026-59902

CVE-2026-59902

High

Open

TLP:CLEAR

Netty: Memory Exhaustion in SctpMessageCompletionHandler

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with large SCTP fragments. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.

Details

CVSS Score: 7.5
EPSS Score ⓘ: 0.68%

49.6th percentile
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Confidence: 90%
Published: Aug 17, 2026
Last Modified: Aug 18, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.