CVE-2026-59902

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with large SCTP fragments. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-400"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59902.json"
}

References

Affected packages

Git / github.com/netty/netty

Affected ranges

Type

GIT

Repo

https://github.com/netty/netty

Events

Introduced

09e64d259c99be8b5b2a471a78f11e65eb82598a

Fixed

5471f0a6ffa4ab39db22c468c6c851af4ecae709

Fixed

e0789d32c72f46fd2e7c99b6fdbbf7e2f4409e44

Fixed

1b5abc6443b63726c72cdd285af2feb7ddbb8ff7

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.1.137.Final"
        },
        {
            "introduced": "4.2.0.Final"
        },
        {
            "fixed": "4.2.17.Final"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

netty-4.*

netty-4.0.0.Alpha1

netty-4.0.0.Alpha2

netty-4.0.0.Alpha3

netty-4.0.0.Alpha4

netty-4.0.0.Alpha5

netty-4.0.0.Alpha6

netty-4.0.0.Alpha7

netty-4.0.0.Alpha8

netty-4.0.0.Beta1

netty-4.0.0.Beta2

netty-4.0.0.Beta3

netty-4.0.0.CR1

netty-4.0.0.CR2

netty-4.0.0.CR3

netty-4.0.0.CR4

netty-4.0.0.CR5

netty-4.0.0.CR7

netty-4.0.0.CR8

netty-4.0.0.CR9

netty-4.0.0.Final

netty-4.0.1.Final

netty-4.0.10.Final

netty-4.0.11.Final

netty-4.0.12.Final

netty-4.0.13.Final

netty-4.0.14.Beta1

netty-4.0.14.Final

netty-4.0.15.Final

netty-4.0.2.Final

netty-4.0.3.Final

netty-4.0.4.Final

netty-4.0.5.Final

netty-4.0.6.Final

netty-4.0.7.Final

netty-4.0.8.Final

netty-4.1.0.Beta1

netty-4.1.0.Beta2

netty-4.1.0.Beta3

netty-4.1.0.Beta4

netty-4.1.0.Beta5

netty-4.1.0.Beta6

netty-4.1.0.Beta7

netty-4.1.0.Beta8

netty-4.1.0.CR1

netty-4.1.0.CR2

netty-4.1.0.CR3

netty-4.1.0.CR4

netty-4.1.0.CR5

netty-4.1.0.CR6

netty-4.1.0.CR7

netty-4.1.0.Final

netty-4.1.1.Final

netty-4.1.10.Final

netty-4.1.100.Final

netty-4.1.101.Final

netty-4.1.102.Final

netty-4.1.103.Final

netty-4.1.104.Final

netty-4.1.105.Final

netty-4.1.106.Final

netty-4.1.107.Final

netty-4.1.108.Final

netty-4.1.109.Final

netty-4.1.11.Final

netty-4.1.110.Final

netty-4.1.111.Final

netty-4.1.112.Final

netty-4.1.113.Final

netty-4.1.114.Final

netty-4.1.115.Final

netty-4.1.116.Final

netty-4.1.117.Final

netty-4.1.118.Final

netty-4.1.119.Final

netty-4.1.12.Final

netty-4.1.120.Final

netty-4.1.121.Final

netty-4.1.122.Final

netty-4.1.123.Final

netty-4.1.124.Final

netty-4.1.125.Final

netty-4.1.126.Final

netty-4.1.127.Final

netty-4.1.128.Final

netty-4.1.129.Final

netty-4.1.13.Final

netty-4.1.130.Final

netty-4.1.131.Final

netty-4.1.132.Final

netty-4.1.133.Final

netty-4.1.134.Final

netty-4.1.135.Final

netty-4.1.136.Final

netty-4.1.14.Final

netty-4.1.15.Final

netty-4.1.16.Final

netty-4.1.17.Final

netty-4.1.18.Final

netty-4.1.19.Final

netty-4.1.2.Final

netty-4.1.20.Final

netty-4.1.21.Final

netty-4.1.22.Final

netty-4.1.23.Final

netty-4.1.24.Final

netty-4.1.25.Final

netty-4.1.26.Final

netty-4.1.27.Final

netty-4.1.28.Final

netty-4.1.29.Final

netty-4.1.3.Final

netty-4.1.30.Final

netty-4.1.31.Final

netty-4.1.32.Final

netty-4.1.33.Final

netty-4.1.34.Final

netty-4.1.35.Final

netty-4.1.36.Final

netty-4.1.37.Final

netty-4.1.38.Final

netty-4.1.39.Final

netty-4.1.4.Final

netty-4.1.40.Final

netty-4.1.41.Final

netty-4.1.42.Final

netty-4.1.43.Final

netty-4.1.44.Final

netty-4.1.45.Final

netty-4.1.46.Final

netty-4.1.47.Final

netty-4.1.48.Final

netty-4.1.49.Final

netty-4.1.5.Final

netty-4.1.50.Final

netty-4.1.51.Final

netty-4.1.52.Final

netty-4.1.53.Final

netty-4.1.54.Final

netty-4.1.55.Final

netty-4.1.56.Final

netty-4.1.57.Final

netty-4.1.58.Final

netty-4.1.59.Final

netty-4.1.6.Final

netty-4.1.60.Final

netty-4.1.61.Final

netty-4.1.62.Final

netty-4.1.63.Final

netty-4.1.64.Final

netty-4.1.65.Final

netty-4.1.66.Final

netty-4.1.67.Final

netty-4.1.68.Final

netty-4.1.69.Final

netty-4.1.7.Final

netty-4.1.70.Final

netty-4.1.71.Final

netty-4.1.72.Final

netty-4.1.73.Final

netty-4.1.74.Final

netty-4.1.75.Final

netty-4.1.76.Final

netty-4.1.77.Final

netty-4.1.78.Final

netty-4.1.79.Final

netty-4.1.8.Final

netty-4.1.80.Final

netty-4.1.81.Final

netty-4.1.82.Final

netty-4.1.83.Final

netty-4.1.84.Final

netty-4.1.85.Final

netty-4.1.86.Final

netty-4.1.87.Final

netty-4.1.88.Final

netty-4.1.89.Final

netty-4.1.9.Final

netty-4.1.90.Final

netty-4.1.91.Final

netty-4.1.92.Final

netty-4.1.93.Final

netty-4.1.94.Final

netty-4.1.95.Final

netty-4.1.96.Final

netty-4.1.97.Final

netty-4.1.98.Final

netty-4.1.99.Final

netty-4.2.0.Final

netty-4.2.1.Final

netty-4.2.10.Final

netty-4.2.11.Final

netty-4.2.12.Final

netty-4.2.13.Final

netty-4.2.14.Final

netty-4.2.15.Final

netty-4.2.16.Final

netty-4.2.2.Final

netty-4.2.3.Final

netty-4.2.4.Final

netty-4.2.5.Final

netty-4.2.6.Final

netty-4.2.7.Final

netty-4.2.8.Final

netty-4.2.9.Final

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59902.json"