VULNERABILITY INTELLIGENCE

CVE-2026-59902

CVSS score7.5 HIGH
EPSS probability0.36%
CISA KEVNot currently listed
Published2026-08-17
Last modified2026-09-23
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Description

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with large SCTP fragments. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.

Weakness classification

  • security-advisories@github.com: CWE-400

Primary references