CVE-2026-59902
Description
A flaw was found in Netty. The SctpMessageCompletionHandler component, which handles Stream Control Transmission Protocol (SCTP) messages, limits incomplete messages and fragment counts but does not properly limit maxBufferedBytes. An unauthenticated remote attacker could send specially crafted, large SCTP fragments, causing memory exhaustion and a denial-of-service (DoS) condition. The issue is fixed in Netty 4.1.137.Final and 4.2.17.Final.
Statement
An Important severity denial-of-service flaw was found in Netty's SCTP transport, which is shipped in a number of Red Hat offerings, including Red Hat build of Apache Camel for Spring Boot, JBoss EAP, Red Hat Single Sign-On, Red Hat JBoss Fuse, and Red Hat Enterprise Linux AI. The io.netty.handler.codec.sctp.SctpMessageCompletionHandler buffers fragments of incomplete SCTP (Stream Control Transmission Protocol) messages. Although the number of concurrent incomplete messages and the number of fragments per message are limited, the total number of buffered bytes is not. An unauthenticated remote attacker who can reach an application that uses Netty's SCTP transport could send specially crafted, large SCTP fragments over a small number of connections, exhausting server memory and causing an OutOfMemoryError and a denial of service. Applications that do not use Netty's SCTP transport are not impacted. Red Hat rates this flaw the same as upstream: CVSS 3.1 score 7.5 (Important). Remediation of the affected Red Hat products is delegated to the respective product teams, with fixes being pursued where the affected component is shipped; product streams in which the vulnerable code is not present were assessed as not affected.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream Netty project has published fixed releases, so updating to a Netty release that contains the upstream fix resolves the issue.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
