CVE-2026-59902: Netty SctpMessageCompletionHandler memory exhaustion

CVE-2026-59902 · Severity: high · CVSS 7.5 · Published 2026-08-17

Netty is a high-performance Java networking library used by many applications to handle network communication. The SCTP (Stream Control Transmission Protocol) message handler in Netty buffers incomplete message fragments but fails to enforce a maximum size limit. An attacker can open connections and send specially crafted SCTP messages to consume gigabytes of memory per connection, causing the affected application to crash or become unresponsive.

Vendors: Maven, Netty Project.

Quick answers

Is CVE-2026-59902 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-59902 being exploited in the wild.
How severe is CVE-2026-59902?
High severity, with a CVSS score of 7.5, published 17 August 2026.
Which products and versions are affected?
io.netty:netty-transport-sctp (Maven) ECOSYSTEM:introduced=4.2.0.Final,fixed=4.2.17.Final; Netty Project Netty Netty Transport SCTP 4.1.0 through 4.1.136.Final, 4.2.0.Final through 4.2.16.Final.
Is there a fix for CVE-2026-59902?
Yes. io.netty:netty-transport-sctp (Maven): upgrade to 4.2.17.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59902 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-59902?
Check whether you run io.netty:netty-transport-sctp (Maven) or Netty Project Netty Netty Transport SCTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • io.netty:netty-transport-sctp (Maven): upgrade to 4.2.17.Final or later
    # set io.netty:netty-transport-sctp to 4.2.17.Final in your pom.xml or build.gradle

Technical details

The vulnerability exists in io.netty.handler.codec.sctp.SctpMessageCompletionHandler, which buffers fragments for incomplete SCTP messages. While a prior fix (CVE-2026-46340) introduced limits on the number of concurrent incomplete messages (maxIncompleteSctpMessages=128) and fragments per message (maxFragments=128), the handler still lacks a maximum byte-size limit. With default settings and typical SCTP chunk sizes of 64KB, an attacker can accumulate approximately 1GB of buffered data per connection (128 messages × 128 fragments × 64KB). By opening multiple concurrent connections, an attacker can rapidly exhaust heap memory and trigger an OutOfMemoryError without requiring authentication or user interaction. The attack vector is the network, and the scope is limited to availability. Patches are available in versions 4.1.137.Final and 4.2.17.Final.

Affected products

  • Netty netty-transport-sctp 4.1.0 through 4.1.136.Final, 4.2.0.Final through 4.2.16.Final

Identifiers

  • CVE-2026-59902
  • GHSA-2qj4-mmr9-4v2f

Timeline

  • 2026-08-17: disclosed: Vulnerability published to GitHub Advisory Database
  • 2026-08-07: patched: Fix merged; patches released in netty-4.1.137.Final and netty-4.2.17.Final

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.