CVE-2026-59902

HighCVSS 7.5/10Last modified Sep 23, 2026

Description

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with large SCTP fragments. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
netty	netty	< 4.1.137.Final; >= 4.2.0.Final, < 4.2.17.Final

References

https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7Patch
https://github.com/netty/netty/pull/17213Issue Tracking, Patch
https://github.com/netty/netty/pull/17217Issue Tracking, Patch
https://github.com/netty/netty/releases/tag/netty-4.1.137.FinalRelease Notes
https://github.com/netty/netty/releases/tag/netty-4.2.17.FinalRelease Notes
https://github.com/netty/netty/security/advisories/GHSA-2qj4-mmr9-4v2fVendor Advisory

Timeline

Published: Aug 17, 2026
Last modified: Sep 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-599037.5Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.c CVE-2026-599097.1Dell ObjectScale, versions prior to 4.3.0.1, contain(s) a Path Traversal vulnerability. A low privileged attacker with local access could po CVE-2026-59918.8A vulnerability was found in Tenda F451 1.0.0.7. Affected by this issue is the function formWrlExtraSet of the file /goform/WrlExtraSet. The CVE-2026-599107.8Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command In CVE-2026-599115.5Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Insertion of Sensitive Information into Log File vulnerability in the svc_tools. CVE-2026-599127.8Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain an Improper Access Control vulnerability. A low privil CVE-2026-599137.8Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain a Missing Authentication for Critical Function vulnera CVE-2026-599147.8Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain an Authentication Bypass by Spoofing vulnerability. CVE-2026-599157.3Dell Alienware Command Center (AWCC), versions prior to 6.14.20.0, contain a Least Privilege Violation vulnerability. A low privileged attac CVE-2026-599167.8Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain Improper Access Control vulnerability. A low privile CVE-2026-599177.8Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain Improper Access Control vulnerability. A low privile CVE-2026-599195.5Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's HAProxy e