Executive brief
Netty is a high-performance Java networking library used by many applications to handle network communication. The SCTP (Stream Control Transmission Protocol) message handler in Netty buffers incomplete message fragments but fails to enforce a maximum size limit. An attacker can open connections and send specially crafted SCTP messages to consume gigabytes of memory per connection, causing the affected application to crash or become unresponsive.
Technical details
The vulnerability exists in io.netty.handler.codec.sctp.SctpMessageCompletionHandler, which buffers fragments for incomplete SCTP messages. While a prior fix (CVE-2026-46340) introduced limits on the number of concurrent incomplete messages (maxIncompleteSctpMessages=128) and fragments per message (maxFragments=128), the handler still lacks a maximum byte-size limit. With default settings and typical SCTP chunk sizes of 64KB, an attacker can accumulate approximately 1GB of buffered data per connection (128 messages × 128 fragments × 64KB). By opening multiple concurrent connections, an attacker can rapidly exhaust heap memory and trigger an OutOfMemoryError without requiring authentication or user interaction. The attack vector is the network, and the scope is limited to availability. Patches are available in versions 4.1.137.Final and 4.2.17.Final.
Affected products
- Netty netty-transport-sctp 4.1.0 through 4.1.136.Final, 4.2.0.Final through 4.2.16.Final
Timeline
- 2026-08-17: disclosed: Vulnerability published to GitHub Advisory Database
- 2026-08-07: patched: Fix merged; patches released in netty-4.1.137.Final and netty-4.2.17.Final