EUVD-2026-60314
GHSA-2qj4-mmr9-4v2f
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable via SCTP with no auth required; availability-only impact (heap exhaustion); AC:L because no race condition or special timing is needed.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
4Blast Radius
ecosystem impact- 75 maven packages depend on io.netty:netty-transport-sctp (3 direct, 72 indirect)
Ecosystem-wide dependent count for version 4.2.0.Final.
DescriptionCVE.org
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with large SCTP fragments. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.
AnalysisAI
Memory exhaustion in Netty's SctpMessageCompletionHandler (netty-transport-sctp) allows unauthenticated remote peers to drive a JVM into OutOfMemoryError by sending oversized, incomplete SCTP message fragments. The handler enforces limits on concurrent incomplete messages and per-message fragment counts - introduced as a fix for the prior CVE-2026-46340 - but omits a corresponding cap on total buffered bytes. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application explicitly uses Netty's SCTP transport - the io.netty:netty-transport-sctp artifact must be on the classpath and the pipeline must include io.netty.handler.codec.sctp.SctpMessageCompletionHandler. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately characterizes the attack as network-reachable and requiring no authentication, with high availability impact - these metrics are consistent with the GHSA advisory's description. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker opens a small number of concurrent SCTP connections to a Netty server running SctpMessageCompletionHandler and sends 128 deliberately incomplete SCTP messages per connection, each fragmented into 128 chunks of approximately 64KB, without ever completing or closing the messages. Each connection consumes roughly 1GB of JVM heap; opening even two or three such connections drives the server into OutOfMemoryError. … |
| Remediation | Upgrade io.netty:netty-transport-sctp to version 4.1.137.Final (for 4.1.x users) or 4.2.17.Final (for 4.2.x users); both are confirmed tagged releases available at https://github.com/netty/netty/releases/tag/netty-4.1.137.Final and https://github.com/netty/netty/releases/tag/netty-4.2.17.Final. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a comprehensive inventory of all applications and services using Netty framework, documenting current versions across production and non-production environments and identifying network accessibility. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Certificate revocation-check bypass in the Netty network framework's OCSP client (io.netty:netty-handler-ssl-ocsp) affec
Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final
Compression-amplification denial of service in the Netty network framework (versions prior to 4.1.136.Final and 4.2.16.F
Memory-amplification denial of service in the Netty network framework (SPDY/3.1 codec) prior to 4.1.136.Final and 4.2.16
Memory-exhaustion denial of service in Netty's HTTP/3 codec (Http3FrameCodec) affects all releases prior to 4.2.16.Final
Denial of service in the Netty HTTP/3 codec (io.netty:netty-codec-http3) prior to version 4.2.15.Final allows remote una
Denial of service in Netty's io.netty:netty-codec-redis component (prior to 4.1.135.Final and 4.2.15.Final) allows remot
Netty project is an event-driven asynchronous network application framework. Rated high severity (CVSS 7.5), this vulner
Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Tr
Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performan
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today