HIGHCVSS 7.5EPSS 0.7%

CVE-2026-59902

CVE-2026-59902 updated by NVD

Published: 2026-08-17
Modified: 2026-09-12
EPSS percentile: 50%
Sources: github-advisory, nvd

Summary

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with large SCTP fragments. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
Maven	io.netty:netty-transport-sctp	—	4.2.17.Final, 4.1.137.Final

Remediation: Upgrade to 4.2.17.Final or later.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-59902

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.