CVE-2026-59902

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.137.Final Netty versions prior to 4.2.17.Final

Description The io.netty.handler.codec.sctp.SctpMessageCompletionHandler buffers fragments for incomplete SCTP messages. Although limits exist for the number of concurrent incomplete messages (maxIncompleteSctpMessages) and fragments per message (maxFragments), there is no limit on the total size of buffered bytes (maxBufferedBytes). This allows an unauthenticated peer to send large SCTP fragments to exhaust server memory, potentially leading to an OutOfMemoryError (a state where the Java Virtual Machine cannot allocate an object because it is out of memory). With default limits, an attacker can consume approximately 1GB per connection.

Recommendations Update to version 4.1.137.Final or later. Update to version 4.2.17.Final or later.