CVE-2026-59902: Memory Exhaustion in Netty SctpMessageCompletionHandler

Vulnerability ID: CVE-2026-59902
CVSS Score: 7.5
Published: 2026-08-17

An uncontrolled resource consumption vulnerability in Netty's SctpMessageCompletionHandler allows unauthenticated remote attackers to cause a Denial of Service. By transmitting a series of large, fragmented Stream Control Transmission Protocol (SCTP) messages, an attacker can exhaust the Java Virtual Machine heap or direct memory. This occurs because the handler fails to enforce limits on the cumulative byte size of buffered, incomplete SCTP fragments.

TL;DR

Unauthenticated remote attackers can crash Netty-based SCTP servers by exhausting JVM memory with unrestricted fragment accumulation.

Technical Details

CWE ID: CWE-400
Attack Vector: Network
CVSS Severity: 7.5 (High)
Exploit Status: none
CISA KEV Status: No

Affected Systems

Netty Transport SCTP (io.netty:netty-transport-sctp)
netty-transport-sctp: < 4.1.137.Final (Fixed in: 4.1.137.Final)
netty-transport-sctp: >= 4.2.0.Final, < 4.2.17.Final (Fixed in: 4.2.17.Final)

Code Analysis

Commit: 1b5abc6

Add maxBufferedBytes ceiling check to SctpMessageCompletionHandler

Mitigation Strategies

Upgrade the Netty transport library dependencies to patched versions (4.1.137.Final / 4.2.17.Final).
Apply network-layer firewall filters to restrict SCTP traffic to authenticated peer endpoints.
Implement rate-limiting controls to restrict concurrent SCTP associations per source IP.

Remediation Steps:

Open the project's dependency configuration file (e.g., pom.xml or build.gradle).
Locate the dependencies associated with the group 'io.netty' and artifact 'netty-transport-sctp'.
Update the version string to '4.1.137.Final' (for 4.1.x projects) or '4.2.17.Final' (for 4.2.x projects).
Rebuild the application and run unit tests to confirm dependency resolution.
Deploy the updated application binary to production environments and monitor JVM memory metrics.