Description

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with large SCTP fragments. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-17T18:17:36.087Z",
  "pubdate": "2026-08-17T18:17:36.087Z",
  "executiveSummary": "A memory exhaustion vulnerability exists in the Netty asynchronous event-driven network application framework, specifically within the SCTP protocol handling implementation. The vulnerability stems from the io.netty.handler.codec.sctp.SctpMessageCompletionHandler class enforcing strict limits on the number of incomplete messages and fragment counts, while completely failing to restrict the maximum buffered bytes (maxBufferedBytes). This oversight allows an unauthenticated remote attacker to transmit maliciously crafted or oversized SCTP fragments over the network, which accumulate indefinitely in memory without constraint.\nThe primary impact of this vulnerability is a Denial of Service (DoS) condition affecting target systems utilizing the vulnerable Netty handlers. By continuously flooding the application with large SCTP fragments, an unauthenticated peer can rapidly exhaust available heap memory, leading to severe resource degradation, application crashes, and potential disruption of dependent network services.\nAffected products include Netty versions prior to 4.1.137.Final and 4.2.17.Final. Exploitation requires network exposure to the vulnerable SCTP endpoint and the ability to establish a connection or transmit data frames to the application. No prior authentication, privileged access, or complex interaction is required, making remote exploitation straightforward for any connected network peer.",
  "technicalDetails": "The root cause of the vulnerability resides in the io.netty.handler.codec.sctp.SctpMessageCompletionHandler component within the Netty framework. When processing fragmented SCTP messages, the handler is designed to reassemble incoming fragments into complete application-level messages before passing them up the pipeline. While the implementation maintains internal counters to limit the total number of incomplete messages and the count of individual fragments being tracked, it omits a crucial threshold mechanism: maxBufferedBytes.\nBecause there is no upper bound enforced on the total aggregate memory consumed by buffered fragments, the system remains entirely unprotected against malicious memory accumulation. An unauthenticated attacker operating over the network can initiate a stream of fragmented SCTP payloads designed never to complete, or transmit excessively large individual fragments that exceed normal operational parameters. As these fragments are received by the network stack and processed by io.netty.handler.codec.sctp.SctpMessageCompletionHandler, Netty allocates internal buffers to store them indefinitely awaiting reassembly completion.\nThe attack flow proceeds as follows: First, the attacker establishes network connectivity to the vulnerable Netty application endpoint configured with SCTP support. Second, the attacker transmits a continuous sequence of large SCTP fragments or initiates numerous fragmented message sequences that intentionally omit final fragments. Third, the vulnerable handler accepts the payloads and allocates memory to buffer the incoming fragments, bypassing any byte-limit checks due to the absence of maxBufferedBytes enforcement. Finally, as the accumulation of buffered data scales linearly with the attacker's transmission rate, the Java Virtual Machine (JVM) heap space is rapidly exhausted, triggering OutOfMemoryError exceptions and terminating the application process.\nThe affected components are specifically the io.netty.handler.codec.sctp.SctpMessageCompletionHandler class across Netty versions prior to 4.1.137.Final and 4.2.17.Final. The vulnerability requires network exposure of the SCTP service, involves zero authentication requirements, and can be exploited by any unauthenticated peer with network access to the target port."
}