CVE-2026-59902
- Source
- https://cve.org/CVERecord?id=CVE-2026-59902
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59902.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-59902
- Aliases
- Downstream
- Related
- Published
- 2026-08-17T17:48:55.663Z
- Modified
- 2026-08-20T10:17:15.954146Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- Netty: Memory Exhaustion in SctpMessageCompletionHandler
- Details
-
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with large SCTP fragments. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-400" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59902.json" }- References
-
- https://github.com/netty/netty/releases/tag/netty-4.1.137.Final
- https://github.com/netty/netty/releases/tag/netty-4.2.17.Final
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59902.json
- https://github.com/netty/netty/security/advisories/GHSA-2qj4-mmr9-4v2f
- https://nvd.nist.gov/vuln/detail/CVE-2026-59902
- https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7
- https://github.com/netty/netty/pull/17213
- https://github.com/netty/netty/pull/17217
Affected packages
Git / github.com/netty/netty
Affected ranges
- Type
- GIT
- Repo
- https://github.com/netty/netty
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedIntroducedFixedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "introduced": "0" }, { "fixed": "4.1.137.Final" }, { "introduced": "4.2.0.Final" }, { "fixed": "4.2.17.Final" } ], "source": [ "AFFECTED_FIELD", "REFERENCES" ] }
Affected versions
netty-4.*
netty-4.0.0.Alpha1
netty-4.0.0.Alpha2
netty-4.0.0.Alpha3
netty-4.0.0.Alpha4
netty-4.0.0.Alpha5
netty-4.0.0.Alpha6
netty-4.0.0.Alpha7
netty-4.0.0.Alpha8
netty-4.0.0.Beta1
netty-4.0.0.Beta2
netty-4.0.0.Beta3
netty-4.0.0.CR1
netty-4.0.0.CR2
netty-4.0.0.CR3
netty-4.0.0.CR4
netty-4.0.0.CR5
netty-4.0.0.CR7
netty-4.0.0.CR8
netty-4.0.0.CR9
netty-4.0.0.Final
netty-4.0.1.Final
netty-4.0.10.Final
netty-4.0.11.Final
netty-4.0.12.Final
netty-4.0.13.Final
netty-4.0.14.Beta1
netty-4.0.14.Final
netty-4.0.15.Final
netty-4.0.2.Final
netty-4.0.3.Final
netty-4.0.4.Final
netty-4.0.5.Final
netty-4.0.6.Final
netty-4.0.7.Final
netty-4.0.8.Final
netty-4.1.0.Beta1
netty-4.1.0.Beta2
netty-4.1.0.Beta3
netty-4.1.0.Beta4
netty-4.1.0.Beta5
netty-4.1.0.Beta6
netty-4.1.0.Beta7
netty-4.1.0.Beta8
netty-4.1.0.CR1
netty-4.1.0.CR2
netty-4.1.0.CR3
netty-4.1.0.CR4
netty-4.1.0.CR5
netty-4.1.0.CR6
netty-4.1.0.CR7
netty-4.1.0.Final
netty-4.1.1.Final
netty-4.1.10.Final
netty-4.1.100.Final
netty-4.1.101.Final
netty-4.1.102.Final
netty-4.1.103.Final
netty-4.1.104.Final
netty-4.1.105.Final
netty-4.1.106.Final
netty-4.1.107.Final
netty-4.1.108.Final
netty-4.1.109.Final
netty-4.1.11.Final
netty-4.1.110.Final
netty-4.1.111.Final
netty-4.1.112.Final
netty-4.1.113.Final
netty-4.1.114.Final
netty-4.1.115.Final
netty-4.1.116.Final
netty-4.1.117.Final
netty-4.1.118.Final
netty-4.1.119.Final
netty-4.1.12.Final
netty-4.1.120.Final
netty-4.1.121.Final
netty-4.1.122.Final
netty-4.1.123.Final
netty-4.1.124.Final
netty-4.1.125.Final
netty-4.1.126.Final
netty-4.1.127.Final
netty-4.1.128.Final
netty-4.1.129.Final
netty-4.1.13.Final
netty-4.1.130.Final
netty-4.1.131.Final
netty-4.1.132.Final
netty-4.1.133.Final
netty-4.1.134.Final
netty-4.1.135.Final
netty-4.1.136.Final
netty-4.1.14.Final
netty-4.1.15.Final
netty-4.1.16.Final
netty-4.1.17.Final
netty-4.1.18.Final
netty-4.1.19.Final
netty-4.1.2.Final
netty-4.1.20.Final
netty-4.1.21.Final
netty-4.1.22.Final
netty-4.1.23.Final
netty-4.1.24.Final
netty-4.1.25.Final
netty-4.1.26.Final
netty-4.1.27.Final
netty-4.1.28.Final
netty-4.1.29.Final
netty-4.1.3.Final
netty-4.1.30.Final
netty-4.1.31.Final
netty-4.1.32.Final
netty-4.1.33.Final
netty-4.1.34.Final
netty-4.1.35.Final
netty-4.1.36.Final
netty-4.1.37.Final
netty-4.1.38.Final
netty-4.1.39.Final
netty-4.1.4.Final
netty-4.1.40.Final
netty-4.1.41.Final
netty-4.1.42.Final
netty-4.1.43.Final
netty-4.1.44.Final
netty-4.1.45.Final
netty-4.1.46.Final
netty-4.1.47.Final
netty-4.1.48.Final
netty-4.1.49.Final
netty-4.1.5.Final
netty-4.1.50.Final
netty-4.1.51.Final
netty-4.1.52.Final
netty-4.1.53.Final
netty-4.1.54.Final
netty-4.1.55.Final
netty-4.1.56.Final
netty-4.1.57.Final
netty-4.1.58.Final
netty-4.1.59.Final
netty-4.1.6.Final
netty-4.1.60.Final
netty-4.1.61.Final
netty-4.1.62.Final
netty-4.1.63.Final
netty-4.1.64.Final
netty-4.1.65.Final
netty-4.1.66.Final
netty-4.1.67.Final
netty-4.1.68.Final
netty-4.1.69.Final
netty-4.1.7.Final
netty-4.1.70.Final
netty-4.1.71.Final
netty-4.1.72.Final
netty-4.1.73.Final
netty-4.1.74.Final
netty-4.1.75.Final
netty-4.1.76.Final
netty-4.1.77.Final
netty-4.1.78.Final
netty-4.1.79.Final
netty-4.1.8.Final
netty-4.1.80.Final
netty-4.1.81.Final
netty-4.1.82.Final
netty-4.1.83.Final
netty-4.1.84.Final
netty-4.1.85.Final
netty-4.1.86.Final
netty-4.1.87.Final
netty-4.1.88.Final
netty-4.1.89.Final
netty-4.1.9.Final
netty-4.1.90.Final
netty-4.1.91.Final
netty-4.1.92.Final
netty-4.1.93.Final
netty-4.1.94.Final
netty-4.1.95.Final
netty-4.1.96.Final
netty-4.1.97.Final
netty-4.1.98.Final
netty-4.1.99.Final
netty-4.2.0.Final
netty-4.2.1.Final
netty-4.2.10.Final
netty-4.2.11.Final
netty-4.2.12.Final
netty-4.2.13.Final
netty-4.2.14.Final
netty-4.2.15.Final
netty-4.2.16.Final
netty-4.2.2.Final
netty-4.2.3.Final
netty-4.2.4.Final
netty-4.2.5.Final
netty-4.2.6.Final
netty-4.2.7.Final
netty-4.2.8.Final
netty-4.2.9.Final
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59902.json"
vanir_signatures
[
{
"target": {
"function": "isValidClientId",
"file": "codec-mqtt/src/main/java/io/netty/handler/codec/mqtt/MqttCodecUtil.java"
},
"deprecated": false,
"source": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7",
"id": "CVE-2026-59902-09f60da2",
"signature_version": "v1",
"digest": {
"length": 352.0,
"function_hash": "84645625814432201414568833146499814498"
},
"signature_type": "Function"
},
{
"target": {
"function": "setVaryHeader",
"file": "codec-http/src/main/java/io/netty/handler/codec/http/cors/CorsHandler.java"
},
"deprecated": false,
"source": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7",
"id": "CVE-2026-59902-0f43863b",
"signature_version": "v1",
"digest": {
"length": 128.0,
"function_hash": "119615223575837566765244065178035964388"
},
"signature_type": "Function"
},
{
"target": {
"file": "codec-http/src/main/java/io/netty/handler/codec/http/cors/CorsHandler.java"
},
"deprecated": false,
"source": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7",
"id": "CVE-2026-59902-11422529",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"282584205391126255837647907041050553449",
"283048779736780770603442295554086408190",
"100876930371897923814101499104129497743",
"199008308800094429100050377126780175696"
]
},
"signature_type": "Line"
},
{
"target": {
"function": "decode",
"file": "handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java"
},
"deprecated": false,
"source": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7",
"id": "CVE-2026-59902-21d5f3b1",
"signature_version": "v1",
"digest": {
"length": 2884.0,
"function_hash": "252078690141458402496369299037055254586"
},
"signature_type": "Function"
},
{
"target": {
"file": "codec-socks/src/main/java/io/netty/handler/codec/socksx/v5/Socks5ClientEncoder.java"
},
"deprecated": false,
"source": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7",
"id": "CVE-2026-59902-30681f6a",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"304606498751136794997495334009706469718",
"107177558362705266919934033521954074373",
"312612808484785104297145008888539600258",
"35245758803194600580908711889200407001",
"238354108155259696271008752013385479962",
"270300201878344652476721605549785029807",
"72829825513142438459188254908891036841",
"47089293698008744633299547383089091190",
"306517148961537934480361984469492279040",
"227186552793503249343697377491982533688",
"95269931787548745384149742689881264668",
"10558365464053181901721546685170591428",
"240934830794011705615802792817939437624",
"331529391539678196836405315176873708507",
"125291516525870151163642122555791228156",
"179978483362159425847774058857652721737",
"699359319783433998045854092820339989",
"264720037604444257106185515973992752963",
"95177562195472807523981881539504970212",
"126574237921925293306150309358777718143",
"292101331211162847832462712267135774864"
]
},
"signature_type": "Line"
},
{
"target": {
"function": "encodePasswordAuthRequest",
"file": "codec-socks/src/main/java/io/netty/handler/codec/socksx/v5/Socks5ClientEncoder.java"
},
"deprecated": false,
"source": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7",
"id": "CVE-2026-59902-368029ba",
"signature_version": "v1",
"digest": {
"length": 354.0,
"function_hash": "310329423977751778849009248867086381741"
},
"signature_type": "Function"
},
{
"target": {
"file": "handler/src/main/java/io/netty/handler/ssl/ReferenceCountedOpenSslClientContext.java"
},
"deprecated": false,
"source": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7",
"id": "CVE-2026-59902-3ee221b5",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"310036972896424658000476504215627599279",
"247837072446337809947776431525354726334",
"295318748867354792658148025094957028217"
]
},
"signature_type": "Line"
},
{
"target": {
"function": "newSessionContext",
"file": "handler/src/main/java/io/netty/handler/ssl/ReferenceCountedOpenSslClientContext.java"
},
"deprecated": false,
"source": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7",
"id": "CVE-2026-59902-44b07a13",
"signature_version": "v1",
"digest": {
"length": 2358.0,
"function_hash": "325296808906152172973103469598499065265"
},
"signature_type": "Function"
},
{
"target": {
"function": "handlerRemoved",
"file": "transport-sctp/src/main/java/io/netty/handler/codec/sctp/SctpMessageCompletionHandler.java"
},
"deprecated": false,
"source": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7",
"id": "CVE-2026-59902-4662e0e8",
"signature_version": "v1",
"digest": {
"length": 245.0,
"function_hash": "47420054499853671149146217798163704091"
},
"signature_type": "Function"
},
{
"target": {
"file": "handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java"
},
"deprecated": false,
"source": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7",
"id": "CVE-2026-59902-4689f3ba",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"246184775773600869047566607006738342941",
"136171328020005735385825093982020434292",
"48891967717621962076763560062401260279",
"243017859132947919530460601943796025897",
"301376082760515948372833318856459321663",
"38201598405175416409141905396385427317",
"141010204002241343644454667834876048245",
"140742950034244572278439772601502659072",
"285785148084756877732616151217461192572",
"88789631643813233179874360722602627371",
"319030582928418178687030118187925984626",
"236031878516828121964179429653790672960",
"57720424749599869264481988427967342331",
"259995779088002293931530194820084828925",
"178181512481523963468654273763466768919",
"108738299475697000460271628495870601100",
"92301227311068822288569505501368903660",
"187941301241634052401231740311233167414",
"246304624714192634660090346318182931925",
"41464477313304192840591094973798237663",
"80381373364519627035269141630362538537",
"272649929434106899316283483131261703055",
"177083057772205109517764026069419634068",
"193562826616644278913883635477375885874",
"265971043263109517224159082275974896626",
"119181800448365908415701241052879092576",
"1049120356518765182706428402304900414",
"219808726095123070908957900198783639275",
"233727041293802880911654219093104111811",
"144828807669585930495707198366288643917",
"267564627683821322436641749747299926025",
"24848216265556955491552320651344407917",
"256150711748354154213801916522710223309",
"274244855218759232965673508540246089855",
"190568197848634380043326987856392746997",
"7302533453887094791276757211012355361",
"268912379440728837551193652881280717869",
"263711980665669032777864889287918493360",
"78085331452233021172407655898475946489",
"293652335232826220076493933431870710607",
"53151260401314179542892604457837072571",
"114376597745264532894503322265842923091",
"288850038036615734249552263179224887109",
"183965643050414617332748854186462607520",
"299949528583978267534967057093722099746",
"329014802329217484151557049421139557709",
"299088250219414814252664064432249298927",
"174450301500139388402489827936901502108",
"256676146810446152553892768095790904094",
"198714208907433092677833060507060183563",
"91193224863128468158980597132645120424"
]
},
"signature_type": "Line"
},
{
"target": {
"function": "encodeConnectMessage",
"file": "codec-mqtt/src/main/java/io/netty/handler/codec/mqtt/MqttEncoder.java"
},
"deprecated": false,
"source": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7",
"id": "CVE-2026-59902-4acd1eba",
"signature_version": "v1",
"digest": {
"length": 2564.0,
"function_hash": "254265270644632936787834493323205555679"
},
"signature_type": "Function"
},
{
"target": {
"file": "codec-socks/src/main/java/io/netty/handler/codec/socksx/v4/Socks4ClientEncoder.java"
},
"deprecated": false,
"source": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7",
"id": "CVE-2026-59902-51f22482",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"316447990029257247595221670681097842755",
"312212151924432295210877849380211943931",
"187748292673265952129518986604757154811",
"58994214456740580087449219923860953908",
"137788579284630482711658921912385032112",
"324670778719064382480485295608500654759",
"7617136440895494601667152917148917672",
"171948312392197549996143862905538187902",
"128194272231139109862194393114415838537",
"300953819359772768659304848127530818552",
"39908338453173826489828870701538957435",
"290663670012994515357791039073594884843",
"336738751569592218709686763008601543117",
"322742193172742231802749933416471989561",
"269575617422615032765970598538415526498",
"327446634071149644449654691163961125854"
]
},
"signature_type": "Line"
},
{
"target": {
"function": "decode",
"file": "transport-sctp/src/main/java/io/netty/handler/codec/sctp/SctpMessageCompletionHandler.java"
},
"deprecated": false,
"source": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7",
"id": "CVE-2026-59902-520a7278",
"signature_version": "v1",
"digest": {
"length": 1264.0,
"function_hash": "310324125594873364831697137830641997450"
},
"signature_type": "Function"
},
{
"target": {
"file": "codec-mqtt/src/test/java/io/netty/handler/codec/mqtt/MqttCodecTest.java"
},
"deprecated": false,
"source": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7",
"id": "CVE-2026-59902-55534946",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"246296576765899052738950942814342455847",
"299788497570909063321551017356741634336",
"97632577803135676825403676511770862789",
"271169408272026655953252212964376482632",
"124662856914275883462376709862196479979",
"64677745737370849163886569475456758293"
]
},
"signature_type": "Line"
},
{
"target": {
"function": "clientHelloInMultipleFragments",
"file": "handler/src/test/java/io/netty/handler/ssl/SniHandlerTest.java"
},
"deprecated": false,
"source": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7",
"id": "CVE-2026-59902-6f894853",
"signature_version": "v1",
"digest": {
"length": 535.0,
"function_hash": "230799569796854585791516719095435473308"
},
"signature_type": "Function"
},
{
"target": {
"file": "transport-sctp/src/test/java/io/netty/handler/codec/sctp/SctpMessageCompletionHandlerTest.java"
},
"deprecated": false,
"source": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7",
"id": "CVE-2026-59902-72882763",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"10342966798946698587409407711814171166",
"316982840733350955723891445650037708990",
"225936985910201744982265163472218884431"
]
},
"signature_type": "Line"
},
{
"target": {
"function": "encode",
"file": "codec-socks/src/main/java/io/netty/handler/codec/socksx/v4/Socks4ClientEncoder.java"
},
"deprecated": false,
"source": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7",
"id": "CVE-2026-59902-730793e6",
"signature_version": "v1",
"digest": {
"length": 677.0,
"function_hash": "48451996250546367794476802560450196851"
},
"signature_type": "Function"
},
{
"target": {
"function": "releaseHandshakeBuffer",
"file": "handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java"
},
"deprecated": false,
"source": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7",
"id": "CVE-2026-59902-7f179796",
"signature_version": "v1",
"digest": {
"length": 78.0,
"function_hash": "65440548176338237486829628028216355573"
},
"signature_type": "Function"
},
{
"target": {
"file": "codec-socks/src/main/java/io/netty/handler/codec/socksx/v5/Socks5ServerEncoder.java"
},
"deprecated": false,
"source": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7",
"id": "CVE-2026-59902-8625aac6",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"111434534492584680139271489916274674933",
"87038988608188958798333953527582762691",
"24179610416960414124112729540661031530",
"101537376295999593172253494069669212656"
]
},
"signature_type": "Line"
},
{
"target": {
"file": "transport-sctp/src/main/java/io/netty/handler/codec/sctp/SctpMessageCompletionHandler.java"
},
"deprecated": false,
"source": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7",
"id": "CVE-2026-59902-8867b1c2",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"331724457763921386641977513232785006130",
"328062504491528246545553621436083225346",
"169873721895551159718450093336668480727",
"107825389270820589157828475113751659000",
"56980330306962477382648312979819793263",
"126564958679592127895324433895158756032",
"144411672403511039102117165178175138846",
"178878799732441104511424107953485814682",
"141798731377658361725548792206821260217",
"6618879759538922833072301215125599244",
"143591152103464931786285702181395980953",
"36573729460907588827634826532713221580",
"155932449538318358231367904734157069015",
"34360655975431730965834468697874162034",
"76607776948033405543449478456878011207",
"153307572811983880941087083956660380126",
"14458711777400876375215947109858766966",
"248985900923046071616415693742253410553",
"146799711745177690487560298738601187225",
"278259369010545182254762585631868019361",
"241239269185157134251086086798614291768",
"170347664070434846901702283111846664721",
"154190756023997702317558097451464763846",
"47127978030989219552306949879596375409",
"163834059175750779721337696234264232885",
"312272159761176127707881467774012950182",
"144549384150896911193773109012576736907",
"4849890904199660095622530456320976350",
"145691052764958929796087637616981731344",
"308418881326159629552517407561911612040",
"260811640641953394575012588488395281974",
"295747577431459138783214723720080232905",
"72139390797139362971079410964272384261",
"304354404882646129729428330018948919759",
"307670452684182456427414009867943974456",
"242343822151361369861172302821819977186",
"91549323879308809019744298424093647069",
"128423189083273786327550237687282668700"
]
},
"signature_type": "Line"
},
{
"target": {
"function": "isValidPublishTopicName",
"file": "codec-mqtt/src/main/java/io/netty/handler/codec/mqtt/MqttCodecUtil.java"
},
"deprecated": false,
"source": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7",
"id": "CVE-2026-59902-9048fd3d",
"signature_version": "v1",
"digest": {
"length": 202.0,
"function_hash": "98649240771088167076618456790384050886"
},
"signature_type": "Function"
},
{
"target": {
"file": "codec-mqtt/src/main/java/io/netty/handler/codec/mqtt/MqttCodecUtil.java"
},
"deprecated": false,
"source": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7",
"id": "CVE-2026-59902-99301aa1",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"235801353208816727555050469333170019217",
"307252540213180357581320991890829750306",
"87730643393368524281248801166721121984",
"67071520422612865668937212843155142957",
"328245283520926205103763874861217083692",
"73401019909556500277015197106656680002",
"224851564078659664545031546891176229938",
"77286247725774255539395707250094811726",
"230195398580170555126767162495991705941",
"149127602935779227619829760486773442472",
"45850024777953181151881568650115809463",
"185124309345634828045767192654358565241",
"218722952016958523235005371820829632568",
"240956277530818201740334239037116141223",
"240701633980126272723014654877705922377",
"76305994507845591334263261925276667073",
"86443636059207854842269731983825353078"
]
},
"signature_type": "Line"
},
{
"target": {
"function": "encodeCommandRequest",
"file": "codec-socks/src/main/java/io/netty/handler/codec/socksx/v5/Socks5ClientEncoder.java"
},
"deprecated": false,
"source": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7",
"id": "CVE-2026-59902-a3e2a8b0",
"signature_version": "v1",
"digest": {
"length": 434.0,
"function_hash": "69511370614020679303822040528637381386"
},
"signature_type": "Function"
},
{
"target": {
"function": "encodePublishMessage",
"file": "codec-mqtt/src/main/java/io/netty/handler/codec/mqtt/MqttEncoder.java"
},
"deprecated": false,
"source": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7",
"id": "CVE-2026-59902-af357cd2",
"signature_version": "v1",
"digest": {
"length": 920.0,
"function_hash": "329763099192128186628254683565943545886"
},
"signature_type": "Function"
},
{
"target": {
"file": "codec-mqtt/src/main/java/io/netty/handler/codec/mqtt/MqttEncoder.java"
},
"deprecated": false,
"source": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7",
"id": "CVE-2026-59902-ba38bc0c",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"147141129864921357664580696149815181157",
"215313122174830754907517210076165162892",
"317109108086997522641525564659888896019",
"109104104056136459873445837776889948839",
"337019637571283019691424531563657687818",
"291992725190988716997817682276514457119",
"93928817973236720917951783942522143417",
"83838478591868831775950194733205864020",
"16758077589871937865641188146186097788",
"276224828043099574677149228740945195154",
"185380752018812209423729576254497477753",
"122333339594184543075852830371967352210",
"218247073419626184255698969645432486211",
"79917951984142327411719643724367587994",
"330248530384044717973514909925575672615",
"216239225304600256369183020953018618958",
"32150687225439002006633803028347016504",
"185048051314563376548476488915567290044",
"19063313762585294654716518342234142527",
"149502762870840764101275969896528099499",
"24861810437109022353197206183565845648"
]
},
"signature_type": "Line"
},
{
"target": {
"file": "codec-mqtt/src/main/java/io/netty/handler/codec/mqtt/MqttDecoder.java"
},
"deprecated": false,
"source": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7",
"id": "CVE-2026-59902-bb757e4d",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"324808690983077469187000235510024481287",
"98212123138503418172244104440671059873",
"46243421001824126733779112587722266493",
"174620413277139414897908432767910194816",
"42614853410147991139623189985691524268"
]
},
"signature_type": "Line"
},
{
"target": {
"file": "codec-http/src/test/java/io/netty/handler/codec/http/cors/CorsHandlerTest.java"
},
"deprecated": false,
"source": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7",
"id": "CVE-2026-59902-bf6c74aa",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"210517043052950601438940914387460280981",
"118591466333902493164760031470481948731",
"158023169324714712007410658600417369277",
"218183605416868312789978120204031715804",
"259496706311343930489148368144980008290",
"107493608204396891282357484067994300984",
"100826063227314915093477939577346625584"
]
},
"signature_type": "Line"
},
{
"target": {
"file": "handler/src/test/java/io/netty/handler/ssl/SniHandlerTest.java"
},
"deprecated": false,
"source": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7",
"id": "CVE-2026-59902-c388541f",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"145049904343987988750562906281679518639",
"165609481076803256483255538768247532029",
"70128208561842956062396506912391859835",
"153596237890617117514334141728639851269",
"150132177913514258149993909467837485357",
"141649640522120108752360727801168836742",
"53812480800437705128987149302751622279",
"159509013192119284195381204561641795833",
"144556419091182904851674524720638915458",
"196820983561557435220055346376359251394",
"39595926778102813810809159081120433023",
"67674864962700762069634164753930034921",
"286119309229834513103946076990355891025",
"50136369565418760784050240635116612482",
"49749201897964775611712928174551828817",
"296041274752186492741171838203213685423",
"210343461612979617559258036000034794951",
"255848377540125292127086631663308012220",
"151181821458566659674376974844598025561",
"144934634921749047103123824257340834629",
"124161889003662987538974952695659946954",
"138602151809220987074637064267633845138",
"103873090672230280668948326505709694961",
"259715737563387588197744891088435765655",
"242662709929262447095431635294093848849",
"219221404182863036596845597416319342985",
"250112583936152390373876478858564874110",
"49785758610807885240685219350646891794",
"148152989663384925013682870084630822556",
"304759890619548824976714686916932966003",
"311800551326773657486799130732346364967",
"276194915984026117238758430067560437272",
"326765604686643967988514431849416936977",
"255774298372383344479635102415452434374",
"28718057413741911473650255803551728851",
"167243224264925904281664481856444755453",
"282020777786190395162392836752681789299",
"305745943735798820755529316468943342959",
"28366614083802310832110595266763498924"
]
},
"signature_type": "Line"
},
{
"target": {
"function": "testWithFragmentSize",
"file": "handler/src/test/java/io/netty/handler/ssl/SniHandlerTest.java"
},
"deprecated": false,
"source": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7",
"id": "CVE-2026-59902-cb3c1410",
"signature_version": "v1",
"digest": {
"length": 804.0,
"function_hash": "21155529716826569494050696720247308407"
},
"signature_type": "Function"
},
{
"target": {
"function": "SctpMessageCompletionHandler",
"file": "transport-sctp/src/main/java/io/netty/handler/codec/sctp/SctpMessageCompletionHandler.java"
},
"deprecated": false,
"source": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7",
"id": "CVE-2026-59902-d598f0d6",
"signature_version": "v1",
"digest": {
"length": 187.0,
"function_hash": "266657134240902874145733690197349386320"
},
"signature_type": "Function"
},
{
"target": {
"function": "encodeAuthMethodRequest",
"file": "codec-socks/src/main/java/io/netty/handler/codec/socksx/v5/Socks5ClientEncoder.java"
},
"deprecated": false,
"source": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7",
"id": "CVE-2026-59902-dc0c2126",
"signature_version": "v1",
"digest": {
"length": 454.0,
"function_hash": "192590091037164635888477825873356956852"
},
"signature_type": "Function"
},
{
"target": {
"function": "encodePrivateAuthRequest",
"file": "codec-socks/src/main/java/io/netty/handler/codec/socksx/v5/Socks5ClientEncoder.java"
},
"deprecated": false,
"source": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7",
"id": "CVE-2026-59902-e1a5098f",
"signature_version": "v1",
"digest": {
"length": 174.0,
"function_hash": "47569753458370203708918479513628561223"
},
"signature_type": "Function"
},
{
"target": {
"function": "decodeConnectionPayload",
"file": "codec-mqtt/src/main/java/io/netty/handler/codec/mqtt/MqttDecoder.java"
},
"deprecated": false,
"source": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7",
"id": "CVE-2026-59902-e1d5b9a8",
"signature_version": "v1",
"digest": {
"length": 1087.0,
"function_hash": "297971898401247072601599399019029608369"
},
"signature_type": "Function"
},
{
"target": {
"function": "split",
"file": "handler/src/test/java/io/netty/handler/ssl/SniHandlerTest.java"
},
"deprecated": false,
"source": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7",
"id": "CVE-2026-59902-e6bd2796",
"signature_version": "v1",
"digest": {
"length": 636.0,
"function_hash": "161456110043363489772646159475215361672"
},
"signature_type": "Function"
},
{
"target": {
"function": "encodeCommandResponse",
"file": "codec-socks/src/main/java/io/netty/handler/codec/socksx/v5/Socks5ServerEncoder.java"
},
"deprecated": false,
"source": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7",
"id": "CVE-2026-59902-e8ca324b",
"signature_version": "v1",
"digest": {
"length": 434.0,
"function_hash": "69511370614020679303822040528637381386"
},
"signature_type": "Function"
}
]
vanir_signatures_modified
"2026-08-20T10:17:15Z"