CVE-2026-59902High· 7.5▾ TwilightNetty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedByt…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 18.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.7%
Last analysed / modified upstream
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with large SCTP fragments. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
io.netty:netty-transport-sctp >= 4.2.0.Final, <= 4.2.16.Finalio.netty:netty-transport-sctp <= 4.1.136.FinalPatched in:
io.netty:netty-transport-sctp 4.2.17.Finalio.netty:netty-transport-sctp 4.1.137.FinalSource: https://github.com/advisories/GHSA-2qj4-mmr9-4v2f
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-75595Critical· 7.4Netty is an asynchronous, event-driven network application framework
CVE-2026-59903Medium· 6.5Netty is an asynchronous, event-driven network application framework
CVE-2026-44250High· 7.5Netty is a network application framework for development of protocol servers and clients
CVE-2026-44890High· 7.5Netty is a network application framework for development of protocol servers and clients
CVE-2026-50011High· 7.5Netty is a network application framework for development of protocol servers and clients
CVE-2026-75596MediumNetty is an asynchronous, event-driven network application framework