ROOT-APP-MAVEN-CVE-2026-45536 CVE-2026-45536 in io.netty:netty-transport-native-epoll - Patched by Root

Root has patched CVE-2026-45536 in the io.netty:netty-transport-native-epoll package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-42577 CVE-2026-42577 in io.netty:netty-transport-native-epoll - Patched by Root

Root has patched CVE-2026-42577 in the io.netty:netty-transport-native-epoll package for Root:Maven. Multiple fixed versions available...

Security Bulletin: Vulnerabilities in netty-codec-http,spring-core,brace-expandsion,netty-transport,log4j-core,spring-expression,js-cookie,spring-security,spring-cloud,spring-boot,spring-hateoas might affect IBM Storage Defender Copy Data Management

Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in netty-codec-http,spring-core,brace-expandsion,netty-transport,log4j-core,spring-expression,js-cookie,spring-security,spring-cloud,spring-boot,spring-hateoas. Vulnerabilities include resource exhaustion and...

io.netty/netty-transport-sctp: Netty: Denial of Service via SCTP memory exhaustion

A flaw was found in Netty. The SctpMessageCompletionHandler component, which handles Stream Control Transmission Protocol SCTP messages, limits incomplete messages and fragment counts but does not properly limit maxBufferedBytes. An unauthenticated remote attacker could send specially crafted,...

ai.spice:spiceai (0.6.0), ch.zzeekk.spark:spark-temporalquery_2.13 (4.0.0) +921 more potentially affected by CVE-2026-59902 via io.netty:netty-transport-sctp (>=4.2.0.final, <=4.2.16.final)

io.netty:netty-transport-sctp MAVEN version =4.2.0.final, =4.2.16.final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty-transport-sctp and may be impacted: - ai.spice:spiceai 0.6.0 - ch.zzeekk.spark:spark-temporalquery2.13 4.0.0 -...

Improperly Controlled Sequential Memory Allocation

Overview Affected versions of this package are vulnerable to Improperly Controlled Sequential Memory Allocation due to unbounded buffering of incomplete SCTP message fragments. An attacker can trigger an OutOfMemoryError by sending large or many fragmented SCTP messages that the handler retains...

netty-transport-sctp: Netty-transport-sctp: Denial of Service due to unbounded memory growth from SctpMessage fragments

A flaw was found in netty-transport-sctp. A remote attacker can exploit this vulnerability by sending specially crafted, non-complete Stream Control Transmission Protocol SCTP message fragments. This can lead to unbounded memory growth within the application, causing a Denial of Service DoS...

netty-transport-sctp: Netty-transport-sctp: Denial of Service due to unbounded memory growth from SctpMessage fragments

A flaw was found in netty-transport-sctp. A remote attacker can exploit this vulnerability by sending specially crafted, non-complete Stream Control Transmission Protocol SCTP message fragments. This can lead to unbounded memory growth within the application, causing a Denial of Service DoS...

netty-transport-sctp: Netty-transport-sctp: Denial of Service due to unbounded memory growth from SctpMessage fragments

A flaw was found in netty-transport-sctp. A remote attacker can exploit this vulnerability by sending specially crafted, non-complete Stream Control Transmission Protocol SCTP message fragments. This can lead to unbounded memory growth within the application, causing a Denial of Service DoS...

netty-transport-sctp: Netty-transport-sctp: Denial of Service due to unbounded memory growth from SctpMessage fragments

A flaw was found in netty-transport-sctp. A remote attacker can exploit this vulnerability by sending specially crafted, non-complete Stream Control Transmission Protocol SCTP message fragments. This can lead to unbounded memory growth within the application, causing a Denial of Service DoS...

netty-transport-sctp: Netty-transport-sctp: Denial of Service due to unbounded memory growth from SctpMessage fragments

A flaw was found in netty-transport-sctp. A remote attacker can exploit this vulnerability by sending specially crafted, non-complete Stream Control Transmission Protocol SCTP message fragments. This can lead to unbounded memory growth within the application, causing a Denial of Service DoS...

CVE-2026-46340

A flaw was found in netty-transport-sctp. A remote attacker can exploit this vulnerability by sending specially crafted, non-complete Stream Control Transmission Protocol SCTP message fragments. This can lead to unbounded memory growth within the application, causing a Denial of Service DoS...

CVE-2026-46340

Netty is a network application framework for development of protocol servers and clients. In versions of netty-transport-sctp prior to 4.1.135.Final and 4.2.15.Final, for each non-complete SctpMessage fragment the handler does fragments.putstreamId, Unpooled.wrappedBufferfrag, byteBuf, wrapping t...

ai.spice:spiceai (0.6.0), ch.zzeekk.spark:spark-temporalquery_2.13 (4.0.0) +846 more potentially affected by CVE-2026-46340 via io.netty:netty-transport-sctp (>=4.2.0.final, <=4.2.14.final)

io.netty:netty-transport-sctp MAVEN version =4.2.0.final, =4.2.14.final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty-transport-sctp and may be impacted: - ai.spice:spiceai 0.6.0 - ch.zzeekk.spark:spark-temporalquery2.13 4.0.0 -...

CVE-2026-46340

Netty is a network application framework for development of protocol servers and clients. In versions of netty-transport-sctp prior to 4.1.135.Final and 4.2.15.Final, for each non-complete SctpMessage fragment the handler does "fragments.putstreamId, Unpooled.wrappedBufferfrag, byteBuf", wrapping...

CVE-2026-46340: Allocation of Resources Without Limits or Throttling

Netty is a network application framework for development of protocol servers and clients. In versions of netty-transport-sctp prior to 4.1.135.Final and 4.2.15.Final, for each non-complete SctpMessage fragment the handler does fragments.putstreamId, Unpooled.wrappedBufferfrag, byteBuf, wrapping t...

Linux Distros Unpatched Vulnerability : CVE-2026-46340

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty is a network application framework for development of protocol servers and clients. In versions of netty-transport-sctp prior to 4.1.135.Final and...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), africa.absa:inception-application (>=1.0.0, <=1.2.0) +29134 more potentially affected by CVE-2026-45536 via io.netty:netty-transport-native-epoll (>=4.0.21.final, <=4.1.134.final)

io.netty:netty-transport-native-epoll MAVEN version =4.0.21.final, =0.0.1, =1.0.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.6.0 - ai.ancf.lmos:lmos-router-hybrid 0.1.0 - ai.ancf.lmos:lmos-router-hybrid-spring-boot-starter 0.1.0 and more Source cves:...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), africa.absa:inception-application (>=1.0.0, <=1.2.0) +29134 more potentially affected by CVE-2026-45536 via io.netty:netty-transport-native-epoll (>=4.0.21.final, <=4.1.134.final)

io.netty:netty-transport-native-epoll MAVEN version =4.0.21.final, =0.0.1, =1.0.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.6.0 - ai.ancf.lmos:lmos-router-hybrid 0.1.0 - ai.ancf.lmos:lmos-router-hybrid-spring-boot-starter 0.1.0 and more Source cves:...

ai.catboost:catboost-spark_4.0_2.13 (1.2.10), ai.catboost:catboost-spark_4.1_2.13 (1.2.10) +6948 more potentially affected by CVE-2026-45536 via io.netty:netty-transport-native-unix-common (>=4.2.0.final, <=4.2.14.final)

io.netty:netty-transport-native-unix-common MAVEN version =4.2.0.final, =0.4.0, =0.4.0, =1.0.0-beta, =0.6.4, =0.6.4, =0.6.4, =0.1.0, =0.1.0, =1.0.0, =1.0.0, =4.13.5, =4.13.5, =4.14.0-rc.2 and more Source cves: CVE-2026-45536 Source advisory: SNYK:JAVA-IONETTY-17260879...