CVE-2026-59902

Katalog CVE

CVSS 7.5 · High EPSS 0,37%

Kerentanan Uncontrolled Resource Consumption pada netty. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with large SCTP fragments. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.

Rincian

Terbit di NVD

17 Agustus 2026

Terakhir diubah

23 September 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 28,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/netty/netty/security/advisories/GHSA-2qj4-mmr9-4v2f advisory vendor
• https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7 patch
• https://github.com/netty/netty/pull/17213 issue tracking · patch
• https://github.com/netty/netty/pull/17217 issue tracking · patch
• https://github.com/netty/netty/releases/tag/netty-4.1.137.Final release notes
• https://github.com/netty/netty/releases/tag/netty-4.2.17.Final release notes