Security Bulletin:Vulnerabilities exists in Netty package used by IBM Netezza Appliance

Summary Vulnerabilities identified in IBM Netezza Appliance have been addressed in the latest security patch release of NPS. Vulnerability Details CVEID:CVE-2026-59902 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final,...

SUSE SLED15 / SLES15 Security Update : netty, netty-tcnative (SUSE-SU-2026:4391-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4391-1 advisory. - CVE-2026-59902: Netty: Memory Exhaustion in SctpMessageCompletionHandler bsc1275501. - CVE-2026-59903: Netty...

SUSE-SU-2026:4391-1 Security update for netty, netty-tcnative

This update for netty, netty-tcnative fixes the following issues: - CVE-2026-59902: Netty: Memory Exhaustion in SctpMessageCompletionHandler bsc1275501. - CVE-2026-59903: Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite bsc1275500. - CVE-2026-62243: TL...

io.netty/netty-transport-sctp: Netty: Denial of Service via SCTP memory exhaustion

A flaw was found in Netty. The SctpMessageCompletionHandler component, which handles Stream Control Transmission Protocol SCTP messages, limits incomplete messages and fragment counts but does not properly limit maxBufferedBytes. An unauthenticated remote attacker could send specially crafted,...

CVE-2026-59902

A flaw was found in Netty. The SctpMessageCompletionHandler component, which handles Stream Control Transmission Protocol SCTP messages, limits incomplete messages and fragment counts but does not properly limit maxBufferedBytes. An unauthenticated remote attacker could send specially crafted,...

CVE-2026-59902

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with...

GHSA-2QJ4-MMR9-4V2F Netty: Memory Exhaustion in SctpMessageCompletionHandler

Summary SctpMessageCompletionHandler does not limit the total size of buffered fragments, allowing an unauthenticated attacker to cause an OutOfMemoryError by sending large SCTP fragments. Details io.netty.handler.codec.sctp.SctpMessageCompletionHandler buffers fragments for incomplete SCTP...

Netty: Memory Exhaustion in SctpMessageCompletionHandler

Summary SctpMessageCompletionHandler does not limit the total size of buffered fragments, allowing an unauthenticated attacker to cause an OutOfMemoryError by sending large SCTP fragments. Details io.netty.handler.codec.sctp.SctpMessageCompletionHandler buffers fragments for incomplete SCTP...

CVE-2026-59902

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with...

CVE-2026-59902

io.netty.handler.codec.sctp.SctpMessageCompletionHandler buffers SCTP fragments without enforcing a maxBufferedBytes limit. With defaults of 128 messages × 128 fragments × ~64KB chunks, an unauthenticated attacker can consume ~1GB per connection, causing OutOfMemoryError. Fixed in Netty 4.1.137.F...

CVE-2026-59902 Netty: Memory Exhaustion in SctpMessageCompletionHandler

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with...

EUVD-2026-60314

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with...

CVE-2026-59902: Uncontrolled Resource Consumption

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with...