CVE-2026-59902 vulnerabilities

Vulnerabilities for packages: tinkerpop, management-api-for-apache-cassandra-4.1, trino, pinot-fips, apache-hop-fips, celeborn, pinot, seata, hadoop-fips, tez, management-api-for-apache-cassandra-4.0, management-api-for-apache-cassandra-5.0, thingsboard...

CVE-2026-59902

creationtimestamp| type| source ---|---|--- 2026-08-17 18:31:27+00:00| seen| https://gist.github.com/alon710/3510ab254b4d34227fef740b05b4af4e...

UBUNTU-CVE-2026-59902

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with...

ai.spice:spiceai (0.6.0), ch.zzeekk.spark:spark-temporalquery_2.13 (4.0.0) +921 more potentially affected by CVE-2026-59902 via io.netty:netty-transport-sctp (>=4.2.0.final, <=4.2.16.final)

io.netty:netty-transport-sctp MAVEN version =4.2.0.final, =4.2.16.final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty-transport-sctp and may be impacted: - ai.spice:spiceai 0.6.0 - ch.zzeekk.spark:spark-temporalquery2.13 4.0.0 -...

CVE-2026-59902 Netty: Memory Exhaustion in SctpMessageCompletionHandler

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with...