All intelligence
// vulnerability record
cached · NVD via COSMOS syncCVE-2026-59902
HIGHpublished 2026-08-17 18:17 UTC · 15 hours ago
7.5
CVSS / 10
// description
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with large SCTP fragments. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.
// weaknesses (CWE)
- CWE-400