CVE-2026-59902High· 7.5▾ TwilightNetty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedByt…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 18.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.7%
Last analysed / modified upstream
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with large SCTP fragments. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.
netty < 4.1.137netty >= 4.2.0, < 4.2.17Upgrade past the affected range:
netty 4.2.17Affected packages:
io.netty:netty-transport-sctp >= 4.2.0.Final, <= 4.2.16.Finalio.netty:netty-transport-sctp <= 4.1.136.FinalPatched in:
io.netty:netty-transport-sctp 4.2.17.Finalio.netty:netty-transport-sctp 4.1.137.FinalSource: https://github.com/advisories/GHSA-2qj4-mmr9-4v2f
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-75595Critical· 9.1Netty is an asynchronous, event-driven network application framework
CVE-2026-59903Medium· 6.5Netty is an asynchronous, event-driven network application framework
CVE-2026-44250High· 7.5Netty is a network application framework for development of protocol servers and clients
CVE-2026-44890High· 7.5Netty is a network application framework for development of protocol servers and clients
CVE-2026-50011High· 7.5Netty is a network application framework for development of protocol servers and clients
CVE-2026-100661High· 7.5Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-integer decoder (QpackUtil.decodePrefixedInteger), which does not bound the numbe…