CVE-2026-46340

Name of the Vulnerable Software and Affected Versions netty-transport-sctp versions prior to 4.1.135.Final netty-transport-sctp versions prior to 4.2.15.Final

Description A remote attacker can cause a Denial of Service (DoS) by sending specially crafted, non-complete Stream Control Transmission Protocol (SCTP) message fragments. The issue occurs because the handler uses fragments.put(streamId, Unpooled.wrappedBuffer(frag, byteBuf)) for each non-complete fragment, creating a new CompositeByteBuf that wraps the previous accumulator. This results in an N-deep chain of composites where readableBytes() or getBytes() calls recurse N levels. Since there are no limits on the number of fragments, total bytes, or the number of streamId entries an attacker can open, a peer that never sets the complete flag can cause unbounded memory growth and excessive system resource consumption.

Recommendations Update netty-transport-sctp to version 4.1.135.Final or later. Update netty-transport-sctp to version 4.2.15.Final or later.