CVE-2026-59902

Description

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with large SCTP fragments. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.

Traduire en français

Produits concernés

• netty
• Netty netty

Scores CVSS

Faiblesses (CWE)

• CWE-400

Références

• https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7 Patch
• https://github.com/netty/netty/pull/17213 Issue TrackingPatch
• https://github.com/netty/netty/pull/17217 Issue TrackingPatch
• https://github.com/netty/netty/releases/tag/netty-4.1.137.Final Release Notes
• https://github.com/netty/netty/releases/tag/netty-4.2.17.Final Release Notes
• https://github.com/netty/netty/security/advisories/GHSA-2qj4-mmr9-4v2f Vendor Advisory

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories