Fluid Attacks Database

Description

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with large SCTP fragments. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 12	netty	=1:4.1.48-10 \|\| =1:4.1.48-11 \|\| =1:4.1.48-12 \|\| =1:4.1.48-13 \|\| =1:4.1.48-14 \|\| =1:4.1.48-15 \|\| =1:4.1.48-16 \|\| =1:4.1.48-7 \|\| =1:4.1.48-7+deb12u1 \|\| =1:4.1.48-7+deb12u2 \|\| =1:4.1.48-8 \|\| =1:4.1.48-9	-
debian 11	netty	=1:4.1.48-10 \|\| =1:4.1.48-11 \|\| =1:4.1.48-12 \|\| =1:4.1.48-13 \|\| =1:4.1.48-14 \|\| =1:4.1.48-15 \|\| =1:4.1.48-16 \|\| =1:4.1.48-4 \|\| =1:4.1.48-4+deb11u1 \|\| =1:4.1.48-4+deb11u2 \|\| =1:4.1.48-4+deb11u3 \|\| =1:4.1.48-5 \|\| =1:4.1.48-6 \|\| =1:4.1.48-7 \|\| =1:4.1.48-8 \|\| =1:4.1.48-9	-
maven	io.netty:netty-transport-sctp	>=4.2.0.final <4.2.17.final \|\| >=0 <4.1.137.final	4.2.17.final, 4.1.137.final
debian 13	netty	=1:4.1.48-10 \|\| =1:4.1.48-10+deb13u1 \|\| =1:4.1.48-11 \|\| =1:4.1.48-12 \|\| =1:4.1.48-13 \|\| =1:4.1.48-14 \|\| =1:4.1.48-15 \|\| =1:4.1.48-16	-
debian 14	netty	=1:4.1.48-10 \|\| =1:4.1.48-11 \|\| =1:4.1.48-12 \|\| =1:4.1.48-13 \|\| =1:4.1.48-14 \|\| =1:4.1.48-15 \|\| =1:4.1.48-16	-

Aliases

1. CVE-2026-599022. NVD-2026-599023. OSV-DEBIAN-2026-599024. OSV-2026-599025. GHSA-2qj4-mmr9-4v2f6. GCVE-2026-599027. SECURITY-TRACKER-CVE-2026-59902

References

1. https://github.com/netty/netty/security/advisories/GHSA-2qj4-mmr9-4v2f2. https://github.com/netty/netty/pull/172133. https://github.com/netty/netty/pull/172174. https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff75. https://github.com/netty/netty/releases/tag/netty-4.1.137.Final6. https://github.com/netty/netty/releases/tag/netty-4.2.17.Final

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.