DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-59902: CVE-2026-59902: Memory Exhaustion in Netty SctpMessageCompletionHandler

#security #cve #cybersecurity

CVE-2026-59902: Memory Exhaustion in Netty SctpMessageCompletionHandler

Vulnerability ID: CVE-2026-59902
CVSS Score: 7.5
Published: 2026-08-17

An uncontrolled resource consumption vulnerability in Netty's SctpMessageCompletionHandler allows unauthenticated remote attackers to cause a Denial of Service. By transmitting a series of large, fragmented Stream Control Transmission Protocol (SCTP) messages, an attacker can exhaust the Java Virtual Machine heap or direct memory. This occurs because the handler fails to enforce limits on the cumulative byte size of buffered, incomplete SCTP fragments.

TL;DR

Unauthenticated remote attackers can crash Netty-based SCTP servers by exhausting JVM memory with unrestricted fragment accumulation.

Technical Details

  • CWE ID: CWE-400
  • Attack Vector: Network
  • CVSS Severity: 7.5 (High)
  • Exploit Status: none
  • CISA KEV Status: No

Affected Systems

  • Netty Transport SCTP (io.netty:netty-transport-sctp)
  • netty-transport-sctp: < 4.1.137.Final (Fixed in: 4.1.137.Final)
  • netty-transport-sctp: >= 4.2.0.Final, < 4.2.17.Final (Fixed in: 4.2.17.Final)

Code Analysis

Commit: 1b5abc6

Add maxBufferedBytes ceiling check to SctpMessageCompletionHandler

Mitigation Strategies

  • Upgrade the Netty transport library dependencies to patched versions (4.1.137.Final / 4.2.17.Final).
  • Apply network-layer firewall filters to restrict SCTP traffic to authenticated peer endpoints.
  • Implement rate-limiting controls to restrict concurrent SCTP associations per source IP.

Remediation Steps:

  1. Open the project's dependency configuration file (e.g., pom.xml or build.gradle).
  2. Locate the dependencies associated with the group 'io.netty' and artifact 'netty-transport-sctp'.
  3. Update the version string to '4.1.137.Final' (for 4.1.x projects) or '4.2.17.Final' (for 4.2.x projects).
  4. Rebuild the application and run unit tests to confirm dependency resolution.
  5. Deploy the updated application binary to production environments and monitor JVM memory metrics.

References

Read the full report for CVE-2026-59902 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)