CVE-2026-59902 Netty: Memory Exhaustion in SctpMessageCompletionHandler

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with...

CVE-2026-59902 Netty: Memory Exhaustion in SctpMessageCompletionHandler

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with...

CVE-2026-59902 Netty: Memory Exhaustion in SctpMessageCompletionHandler

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with...

CVE-2026-59902

io.netty.handler.codec.sctp.SctpMessageCompletionHandler buffers SCTP fragments without enforcing a maxBufferedBytes limit. With defaults of 128 messages × 128 fragments × ~64KB chunks, an unauthenticated attacker can consume ~1GB per connection, causing OutOfMemoryError. Fixed in Netty 4.1.137.F...

EUVD-2026-60314

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with...

CVE-2026-59902

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with...

CVE-2026-59902

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with...

CVE-2026-72021

A flaw was found in the kernel's IP Virtual Server IPVS component. This vulnerability occurs when the setsctpstate function incorrectly calculates the offset for Stream Control Transmission Protocol SCTP chunk headers in IPv6 packets that contain extension headers. A remote attacker could exploit...

USN-8629-2 linux-aws-7.0 vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - x86 architecture; - InfiniBand drivers; - Network drivers; - Network traffic control; - IPv4 networking; - IPv6...

PT-2026-76750

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100543)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100543 advisory. In the Linux kernel, the following vulnerability has been resolved: sctp: fix OOB write to userspace in sctpgetsockoptpeerauthchunks sctpgetsockoptpeerauthchunks...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099785)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099785 advisory. In the Linux kernel, the following vulnerability has been resolved: sctp: stream: fully roll back denied add-stream state When ADDOUTSTREAMS is denied, SCTP only...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100738)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100738 advisory. In the Linux kernel, the following vulnerability has been resolved: sctp: diag: reject stale associations in dumpone path The SCTP exact sockdiag lookup can hold a...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-100132)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100132 advisory. In the Linux kernel, the following vulnerability has been resolved: sctp: diag: reject stale associations in dumpone path The SCTP exact sockdiag lookup can hold a...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100555)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100555 advisory. In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in sctprcvasconflookup sctprcvasconflookup in net/sctp/input.c only check...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-100113)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100113 advisory. In the Linux kernel, the following vulnerability has been resolved: sctp: fix race between sctpwaitforconnect and peeloff sctpwaitforconnect drops and re-acquires th...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099916)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099916 advisory. In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in sctprcvasconflookup sctprcvasconflookup in net/sctp/input.c only check...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100566)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100566 advisory. In the Linux kernel, the following vulnerability has been resolved: sctp: fix race between sctpwaitforconnect and peeloff sctpwaitforconnect drops and re-acquires th...

SUSE CVE-2026-74469

In the Linux kernel, the following vulnerability has been resolved: sctp: prevent peer transport count overflow sctpassocaddpeer increments the association's 16-bit transportcount for every new unique peer. Adding the 65,536th transport wraps the count to zero. SCTP sockdiag uses transportcount t...

CVE-2026-74469

In the Linux kernel, the following vulnerability has been resolved: sctp: prevent peer transport count overflow sctpassocaddpeer increments the association's 16-bit transportcount for every new unique peer. Adding the 65,536th transport wraps the count to zero. SCTP sockdiag uses transportcount t...