CVE-2026-59902
Fixed in a distro release EPSS <1%CVSS 7.5
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with large SCTP fragments. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.
Products: netty
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | io.netty:netty-transport-sctp | 4.2.17.Final |
| Maven | io.netty:netty-transport-sctp | 4.1.137.Final |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | apache-hop-fips | 2.19.0-r0 |
| Chainguard | celeborn-0.5 | 0.5.4-r34 |
| Chainguard | celeborn-0.6 | 0.6.3-r15 |
| Chainguard | gremlin-server | 3.8.1-r1 |
| Chainguard | hadoop-3.5 | no fix |
| Chainguard | hadoop-fips-3.3.6 | no fix |
| Chainguard | hadoop-fips-3.4.2 | no fix |
| Chainguard | hadoop-fips-3.5 | 3.5.0-r3 |
| Chainguard | hadoop-fips-3.5 | no fix |
| Chainguard | management-api-for-apache-cassandra-4.0 | 0.1.125-r1 |
| Chainguard | management-api-for-apache-cassandra-4.1 | 0.1.124-r1 |
| Chainguard | management-api-for-apache-cassandra-5.0 | 0.1.124-r1 |
| Chainguard | pinot | 1.5.1-r16 |
| Chainguard | pinot-fips | 1.5.1-r12 |
| Chainguard | ranger | no fix |
| Chainguard | seata-server | 2.7.0-r5 |
| Chainguard | tez | 0.10.5-r27 |
| Chainguard | thingsboard-tb-mqtt-transport | 4.3.1.3-r21 |
| Chainguard | thingsboard-tb-node | 4.3.1.3-r21 |
| Chainguard | trino | no fix |
| Chainguard | trino-plugin-bigquery | no fix |
| Chainguard | trino-plugin-delta-lake | 483-r3 |
| Chainguard | trino-plugin-hive | 483-r3 |
| Chainguard | trino-plugin-hudi | 483-r3 |
| Chainguard | trino-plugin-iceberg | 483-r3 |
| Chainguard | trino-plugin-lakehouse | 483-r3 |
| Chainguard | trino-plugin-opensearch | no fix |
| Chainguard | trino-plugin-oracle | 483-r7 |
| Chainguard | trino-plugin-pinot | 483-r3 |
| Chainguard | trino-plugin-teradata-functions | 483-r7 |
| Debian 12 | netty | no fix |
| Debian 13 | netty | no fix |
| Debian 14 | netty | no fix |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | netty-tcnative | 2.0.84-150200.3.51.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | netty-tcnative | 2.0.84-150200.3.51.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | netty-tcnative | 2.0.84-150200.3.51.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | netty-tcnative | 2.0.84-150200.3.51.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP7 | netty-tcnative | 2.0.84-150200.3.51.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | netty | 4.1.138-150200.4.56.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | netty-tcnative | 2.0.84-150200.3.51.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | netty-tcnative | 2.0.84-150200.3.51.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | netty-tcnative | 2.0.84-150200.3.51.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | netty-tcnative | 2.0.84-150200.3.51.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | netty-tcnative | 2.0.84-150200.3.51.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | netty-tcnative | 2.0.84-150200.3.51.1 |
| Ubuntu 26.10 | netty | no fix |
| Ubuntu Pro 14.04 LTS | netty | no fix |
| Ubuntu Pro 16.04 LTS | netty | no fix |
| Ubuntu Pro 18.04 LTS | netty | no fix |
| Ubuntu Pro 20.04 LTS | netty | no fix |
| Ubuntu Pro 22.04 LTS | netty | no fix |
| Ubuntu Pro 24.04 LTS | netty | no fix |
| Ubuntu Pro 26.04 LTS | netty | no fix |
| Wolfi | celeborn-0.6 | 0.6.3-r15 |
| Wolfi | management-api-for-apache-cassandra-5.0 | 0.1.124-r1 |
| Wolfi | tez | 0.10.5-r27 |
| Wolfi | thingsboard-tb-mqtt-transport | 4.3.1.3-r21 |
| Wolfi | thingsboard-tb-node | 4.3.1.3-r21 |
| Wolfi | trino | no fix |
| Wolfi | trino-plugin-bigquery | no fix |
| Wolfi | trino-plugin-delta-lake | 483-r3 |
| Wolfi | trino-plugin-hive | 483-r3 |
| Wolfi | trino-plugin-hudi | 483-r3 |
| Wolfi | trino-plugin-iceberg | 483-r3 |
| Wolfi | trino-plugin-lakehouse | 483-r3 |
| Wolfi | trino-plugin-opensearch | no fix |
| Wolfi | trino-plugin-oracle | 483-r7 |
| Wolfi | trino-plugin-pinot | 483-r3 |
| Wolfi | trino-plugin-teradata-functions | 483-r7 |
| openSUSE Tumbleweed | netty | 4.1.138-1.1 |