PT-2026-47552 · Maven · Io.Netty:Netty-Transport-Sctp

Published 2026-06-08 · Updated 2026-06-08

OSV

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

For each non-complete SctpMessage fragment the handler does fragments.put(streamId, Unpooled.wrappedBuffer(frag, byteBuf)), wrapping the previous accumulator and the new slice into a new CompositeByteBuf every time. After N fragments the accumulator is an N-deep chain of composites, each holding references and component arrays; readableBytes()/getBytes() on the final buffer recurse N levels. There is no limit on N, on total bytes, or on the number of streamIdentifiers an attacker can open (each gets its own map entry). A peer that never sets the complete flag can grow this structure indefinitely from tiny 1-byte DATA chunks.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

GHSA-5XRH-QMMQ-W6CH

Affected Products

Io.Netty:Netty-Transport-Sctp

References · 5

• https://osv.dev/vulnerability/GHSA-5xrh-qmmq-w6ch · Vendor Advisory
• https://github.com/netty/netty · Note
• https://github.com/netty/netty/releases/tag/netty-4.2.15.Final · Note
• https://github.com/netty/netty/security/advisories/GHSA-5xrh-qmmq-w6ch · Note
• https://github.com/netty/netty/releases/tag/netty-4.1.135.Final · Note