Executive brief
Netty is a widely used networking framework that helps developers build high-performance servers and clients. A vulnerability in its SCTP protocol component allows a remote attacker to crash a server by sending a large number of small, incomplete message fragments. This can lead to a total service outage as the server exhausts its available memory trying to process the malicious data.
Technical details
A resource exhaustion vulnerability exists in the netty-transport-sctp component of the Netty framework. The SCTP message handler fails to limit the number of fragments or total bytes accumulated for incomplete SctpMessages. Specifically, the handler wraps each new fragment into a new CompositeByteBuf, creating an N-deep recursive chain of objects. An unauthenticated remote attacker can exploit this by sending a continuous stream of 1-byte DATA chunks without ever setting the 'complete' flag, leading to unbounded memory consumption and eventual stack overflow or OutOfMemoryError during buffer access. The issue is fixed in versions 4.1.135.Final and 4.2.15.Final by limiting the number of inflight incomplete messages and fragments.
Affected products
- Netty netty-transport-sctp < 4.1.135.Final, >= 4.2.0.Final, <= 4.2.14.Final
Timeline
- 2026-06-02: patched: Fixes released in 4.1.135.Final and 4.2.15.Final
- 2026-06-05: advisory: GitHub Security Advisory GHSA-5xrh-qmmq-w6ch published
- 2026-06-12: disclosed: CVE-2026-46340 published to NVD