{"id":"CVE-2026-59902","aliases":["CLSA-2026-1788874301","CLSA-2026-1789142484","CLSA-2026-1789146166","CLSA-2026-1789211588","CLSA-2026-1789219941","CLSA-2026-1789219944","CLSA-2026-1789387099","CLSA-2026-1790853416","CLSA-2026-1792115780","CLSA-2026-1792666293","CLSA-2026-1793707066","CLSA-2026-1793709318","CLSA-2026-1793711679","CLSA-2026-1793728348","CLSA-2026-1793731803","CLSA-2026-1793781915","CLSA-2026-1793864924","CLSA-2026-1793866195","CLSA-2026-1794232233","DEBIAN-CVE-2026-59902","EUVD-2026-60314","GHSA-2qj4-mmr9-4v2f","GHSA-5xrh-qmmq-w6ch","RHLW-2026-4140a7a9c48db376","SUSE-SU-2026:4391-1","UBUNTU-CVE-2026-59902","openSUSE-SU-2026:11882-1"],"status":"published","title":"Netty: Memory Exhaustion in SctpMessageCompletionHandler","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with large SCTP fragments. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00365,"percentile":0.30779,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2026-08-17T17:48:55Z","modified":"2026-11-09T19:15:14Z","fixes":[{"ecosystem":"Maven","package":"io.netty:netty-transport-sctp","fixed_in":["4.2.17.Final","4.1.137.Final"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-sctp","fixed_in":["4.1.122.Final-tuxcare.3","4.1.119.Final-tuxcare.2","4.1.111.Final-tuxcare.2","4.1.117.Final-tuxcare.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0.Final"},{"last_affected":"4.2.16.Final"},{"fixed":"4.2.17.Final"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.1.136.Final"},{"fixed":"4.1.137.Final"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.3"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1","4.1.122.Final-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.94.Final"},{"fixed":"4.1.94.Final-tuxcare.2"}]}],"versions":["4.1.94.Final","4.1.94.Final-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.94.Final"},{"fixed":"4.1.94.Final-tuxcare.2"}]}],"versions":["4.1.94.Final","4.1.94.Final-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-classes-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.94.Final"},{"fixed":"4.1.94.Final-tuxcare.2"}]}],"versions":["4.1.94.Final","4.1.94.Final-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.94.Final"},{"fixed":"4.1.94.Final-tuxcare.2"}]}],"versions":["4.1.94.Final","4.1.94.Final-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.2"}]}],"versions":["4.1.119.Final","4.1.119.Final-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.111.Final"},{"fixed":"4.1.111.Final-tuxcare.2"}]}],"versions":["4.1.111.Final","4.1.111.Final-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.117.Final"},{"fixed":"4.1.117.Final-tuxcare.4"}]}],"versions":["4.1.117.Final","4.1.117.Final-tuxcare.1","4.1.117.Final-tuxcare.2","4.1.117.Final-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.108.Final"},{"fixed":"4.1.108.Final-tuxcare.2"}]}],"versions":["4.1.108.Final","4.1.108.Final-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.108.Final"},{"fixed":"4.1.108.Final-tuxcare.2"}]}],"versions":["4.1.108.Final","4.1.108.Final-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.93.Final"},{"fixed":"4.1.93.Final-tuxcare.4"}]}],"versions":["4.1.93.Final","4.1.93.Final-tuxcare.1","4.1.93.Final-tuxcare.2","4.1.93.Final-tuxcare.3"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.93.Final"},{"fixed":"4.1.93.Final-tuxcare.4"}]}],"versions":["4.1.93.Final","4.1.93.Final-tuxcare.1","4.1.93.Final-tuxcare.2","4.1.93.Final-tuxcare.3"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.93.Final"},{"fixed":"4.1.93.Final-tuxcare.4"}]}],"versions":["4.1.93.Final","4.1.93.Final-tuxcare.1","4.1.93.Final-tuxcare.2","4.1.93.Final-tuxcare.3"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.93.Final"},{"fixed":"4.1.93.Final-tuxcare.4"}]}],"versions":["4.1.93.Final","4.1.93.Final-tuxcare.1","4.1.93.Final-tuxcare.2","4.1.93.Final-tuxcare.3"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.93.Final"},{"fixed":"4.1.93.Final-tuxcare.4"}]}],"versions":["4.1.93.Final","4.1.93.Final-tuxcare.1","4.1.93.Final-tuxcare.2","4.1.93.Final-tuxcare.3"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.93.Final"},{"fixed":"4.1.93.Final-tuxcare.4"}]}],"versions":["4.1.93.Final","4.1.93.Final-tuxcare.1","4.1.93.Final-tuxcare.2","4.1.93.Final-tuxcare.3"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-kqueue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.93.Final"},{"fixed":"4.1.93.Final-tuxcare.4"}]}],"versions":["4.1.93.Final","4.1.93.Final-tuxcare.1","4.1.93.Final-tuxcare.2","4.1.93.Final-tuxcare.3"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.93.Final"},{"fixed":"4.1.93.Final-tuxcare.4"}]}],"versions":["4.1.93.Final","4.1.93.Final-tuxcare.1","4.1.93.Final-tuxcare.2","4.1.93.Final-tuxcare.3"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.107.Final"},{"fixed":"4.1.107.Final-tuxcare.2"}]}],"versions":["4.1.107.Final","4.1.107.Final-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.107.Final"},{"fixed":"4.1.107.Final-tuxcare.2"}]}],"versions":["4.1.107.Final","4.1.107.Final-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-classes-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.107.Final"},{"fixed":"4.1.107.Final-tuxcare.2"}]}],"versions":["4.1.107.Final","4.1.107.Final-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.107.Final"},{"fixed":"4.1.107.Final-tuxcare.2"}]}],"versions":["4.1.107.Final","4.1.107.Final-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.115.Final"},{"fixed":"4.1.115.Final-tuxcare.9"}]}],"versions":["4.1.115.Final","4.1.115.Final-tuxcare.1","4.1.115.Final-tuxcare.3","4.1.115.Final-tuxcare.4","4.1.115.Final-tuxcare.5","4.1.115.Final-tuxcare.6","4.1.115.Final-tuxcare.7","4.1.115.Final-tuxcare.8"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.115.Final"},{"fixed":"4.1.115.Final-tuxcare.9"}]}],"versions":["4.1.115.Final","4.1.115.Final-tuxcare.1","4.1.115.Final-tuxcare.3","4.1.115.Final-tuxcare.4","4.1.115.Final-tuxcare.5","4.1.115.Final-tuxcare.6","4.1.115.Final-tuxcare.7","4.1.115.Final-tuxcare.8"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.115.Final"},{"fixed":"4.1.115.Final-tuxcare.9"}]}],"versions":["4.1.115.Final","4.1.115.Final-tuxcare.1","4.1.115.Final-tuxcare.3","4.1.115.Final-tuxcare.4","4.1.115.Final-tuxcare.5","4.1.115.Final-tuxcare.6","4.1.115.Final-tuxcare.7","4.1.115.Final-tuxcare.8"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.115.Final"},{"fixed":"4.1.115.Final-tuxcare.9"}]}],"versions":["4.1.115.Final","4.1.115.Final-tuxcare.1","4.1.115.Final-tuxcare.3","4.1.115.Final-tuxcare.4","4.1.115.Final-tuxcare.5","4.1.115.Final-tuxcare.6","4.1.115.Final-tuxcare.7","4.1.115.Final-tuxcare.8"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.115.Final"},{"fixed":"4.1.115.Final-tuxcare.9"}]}],"versions":["4.1.115.Final","4.1.115.Final-tuxcare.1","4.1.115.Final-tuxcare.3","4.1.115.Final-tuxcare.4","4.1.115.Final-tuxcare.5","4.1.115.Final-tuxcare.6","4.1.115.Final-tuxcare.7","4.1.115.Final-tuxcare.8"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.115.Final"},{"fixed":"4.1.115.Final-tuxcare.9"}]}],"versions":["4.1.115.Final","4.1.115.Final-tuxcare.1","4.1.115.Final-tuxcare.3","4.1.115.Final-tuxcare.4","4.1.115.Final-tuxcare.5","4.1.115.Final-tuxcare.6","4.1.115.Final-tuxcare.7","4.1.115.Final-tuxcare.8"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-kqueue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.115.Final"},{"fixed":"4.1.115.Final-tuxcare.9"}]}],"versions":["4.1.115.Final","4.1.115.Final-tuxcare.1","4.1.115.Final-tuxcare.3","4.1.115.Final-tuxcare.4","4.1.115.Final-tuxcare.5","4.1.115.Final-tuxcare.6","4.1.115.Final-tuxcare.7","4.1.115.Final-tuxcare.8"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.115.Final"},{"fixed":"4.1.115.Final-tuxcare.9"}]}],"versions":["4.1.115.Final","4.1.115.Final-tuxcare.1","4.1.115.Final-tuxcare.3","4.1.115.Final-tuxcare.4","4.1.115.Final-tuxcare.5","4.1.115.Final-tuxcare.6","4.1.115.Final-tuxcare.7","4.1.115.Final-tuxcare.8"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.128.Final"},{"fixed":"4.1.128.Final-tuxcare.1"}]}],"versions":["4.1.128.Final"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.128.Final"},{"fixed":"4.1.128.Final-tuxcare.1"}]}],"versions":["4.1.128.Final"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.128.Final"},{"fixed":"4.1.128.Final-tuxcare.1"}]}],"versions":["4.1.128.Final"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.128.Final"},{"fixed":"4.1.128.Final-tuxcare.1"}]}],"versions":["4.1.128.Final"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.128.Final"},{"fixed":"4.1.128.Final-tuxcare.1"}]}],"versions":["4.1.128.Final"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.128.Final"},{"fixed":"4.1.128.Final-tuxcare.1"}]}],"versions":["4.1.128.Final"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.128.Final"},{"fixed":"4.1.128.Final-tuxcare.1"}]}],"versions":["4.1.128.Final"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.128.Final"},{"fixed":"4.1.128.Final-tuxcare.1"}]}],"versions":["4.1.128.Final"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.113.Final"},{"fixed":"4.1.113.Final-tuxcare.2"}]}],"versions":["4.1.113.Final","4.1.113.Final-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.113.Final"},{"fixed":"4.1.113.Final-tuxcare.2"}]}],"versions":["4.1.113.Final","4.1.113.Final-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.113.Final"},{"fixed":"4.1.113.Final-tuxcare.2"}]}],"versions":["4.1.113.Final","4.1.113.Final-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.113.Final"},{"fixed":"4.1.113.Final-tuxcare.2"}]}],"versions":["4.1.113.Final","4.1.113.Final-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.113.Final"},{"fixed":"4.1.113.Final-tuxcare.2"}]}],"versions":["4.1.113.Final","4.1.113.Final-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.113.Final"},{"fixed":"4.1.113.Final-tuxcare.2"}]}],"versions":["4.1.113.Final","4.1.113.Final-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.113.Final"},{"fixed":"4.1.113.Final-tuxcare.2"}]}],"versions":["4.1.113.Final","4.1.113.Final-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.113.Final"},{"fixed":"4.1.113.Final-tuxcare.2"}]}],"versions":["4.1.113.Final","4.1.113.Final-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.113.Final"},{"fixed":"4.1.113.Final-tuxcare.2"}]}],"versions":["4.1.113.Final","4.1.113.Final-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.101.Final"},{"fixed":"4.1.101.Final-tuxcare.2"}]}],"versions":["4.1.101.Final","4.1.101.Final-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.101.Final"},{"fixed":"4.1.101.Final-tuxcare.2"}]}],"versions":["4.1.101.Final","4.1.101.Final-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-mqtt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.101.Final"},{"fixed":"4.1.101.Final-tuxcare.2"}]}],"versions":["4.1.101.Final","4.1.101.Final-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.101.Final"},{"fixed":"4.1.101.Final-tuxcare.2"}]}],"versions":["4.1.101.Final","4.1.101.Final-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-smtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.101.Final"},{"fixed":"4.1.101.Final-tuxcare.2"}]}],"versions":["4.1.101.Final","4.1.101.Final-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.101.Final"},{"fixed":"4.1.101.Final-tuxcare.2"}]}],"versions":["4.1.101.Final","4.1.101.Final-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.101.Final"},{"fixed":"4.1.101.Final-tuxcare.2"}]}],"versions":["4.1.101.Final","4.1.101.Final-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.101.Final"},{"fixed":"4.1.101.Final-tuxcare.2"}]}],"versions":["4.1.101.Final","4.1.101.Final-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.2.Final"},{"fixed":"4.2.2.Final-tuxcare.2"}]}],"versions":["4.2.2.Final","4.2.2.Final-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.2.Final"},{"fixed":"4.2.2.Final-tuxcare.2"}]}],"versions":["4.2.2.Final","4.2.2.Final-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.2.Final"},{"fixed":"4.2.2.Final-tuxcare.2"}]}],"versions":["4.2.2.Final","4.2.2.Final-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.2.Final"},{"fixed":"4.2.2.Final-tuxcare.2"}]}],"versions":["4.2.2.Final","4.2.2.Final-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.2.Final"},{"fixed":"4.2.2.Final-tuxcare.2"}]}],"versions":["4.2.2.Final","4.2.2.Final-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.2.Final"},{"fixed":"4.2.2.Final-tuxcare.2"}]}],"versions":["4.2.2.Final","4.2.2.Final-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.2.Final"},{"fixed":"4.2.2.Final-tuxcare.2"}]}],"versions":["4.2.2.Final","4.2.2.Final-tuxcare.1"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.96.Final"},{"fixed":"4.1.96.Final-tuxcare.2"}]}],"versions":["4.1.96.Final","4.1.96.Final-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.96.Final"},{"fixed":"4.1.96.Final-tuxcare.2"}]}],"versions":["4.1.96.Final","4.1.96.Final-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.96.Final"},{"fixed":"4.1.96.Final-tuxcare.2"}]}],"versions":["4.1.96.Final","4.1.96.Final-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.100.Final"},{"fixed":"4.1.100.Final-tuxcare.2"}]}],"versions":["4.1.100.Final","4.1.100.Final-tuxcare.1"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.100.Final"},{"fixed":"4.1.100.Final-tuxcare.2"}]}],"versions":["4.1.100.Final","4.1.100.Final-tuxcare.1"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-mqtt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.100.Final"},{"fixed":"4.1.100.Final-tuxcare.2"}]}],"versions":["4.1.100.Final","4.1.100.Final-tuxcare.1"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.100.Final"},{"fixed":"4.1.100.Final-tuxcare.2"}]}],"versions":["4.1.100.Final","4.1.100.Final-tuxcare.1"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.100.Final"},{"fixed":"4.1.100.Final-tuxcare.2"}]}],"versions":["4.1.100.Final","4.1.100.Final-tuxcare.1"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.100.Final"},{"fixed":"4.1.100.Final-tuxcare.2"}]}],"versions":["4.1.100.Final","4.1.100.Final-tuxcare.1"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.99.Final"},{"fixed":"4.1.99.Final-tuxcare.3"}]}],"versions":["4.1.99.Final","4.1.99.Final-tuxcare.1","4.1.99.Final-tuxcare.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.99.Final"},{"fixed":"4.1.99.Final-tuxcare.3"}]}],"versions":["4.1.99.Final","4.1.99.Final-tuxcare.1","4.1.99.Final-tuxcare.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.99.Final"},{"fixed":"4.1.99.Final-tuxcare.3"}]}],"versions":["4.1.99.Final","4.1.99.Final-tuxcare.1","4.1.99.Final-tuxcare.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.99.Final"},{"fixed":"4.1.99.Final-tuxcare.3"}]}],"versions":["4.1.99.Final","4.1.99.Final-tuxcare.1","4.1.99.Final-tuxcare.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-classes-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.99.Final"},{"fixed":"4.1.99.Final-tuxcare.3"}]}],"versions":["4.1.99.Final","4.1.99.Final-tuxcare.1","4.1.99.Final-tuxcare.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.99.Final"},{"fixed":"4.1.99.Final-tuxcare.3"}]}],"versions":["4.1.99.Final","4.1.99.Final-tuxcare.1","4.1.99.Final-tuxcare.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.114.Final"},{"fixed":"4.1.114.Final-tuxcare.3"}]}],"versions":["4.1.114.Final","4.1.114.Final-tuxcare.1","4.1.114.Final-tuxcare.2"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.114.Final"},{"fixed":"4.1.114.Final-tuxcare.3"}]}],"versions":["4.1.114.Final","4.1.114.Final-tuxcare.1","4.1.114.Final-tuxcare.2"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.114.Final"},{"fixed":"4.1.114.Final-tuxcare.3"}]}],"versions":["4.1.114.Final","4.1.114.Final-tuxcare.1","4.1.114.Final-tuxcare.2"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.114.Final"},{"fixed":"4.1.114.Final-tuxcare.3"}]}],"versions":["4.1.114.Final","4.1.114.Final-tuxcare.1","4.1.114.Final-tuxcare.2"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.114.Final"},{"fixed":"4.1.114.Final-tuxcare.3"}]}],"versions":["4.1.114.Final","4.1.114.Final-tuxcare.1","4.1.114.Final-tuxcare.2"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.114.Final"},{"fixed":"4.1.114.Final-tuxcare.3"}]}],"versions":["4.1.114.Final","4.1.114.Final-tuxcare.1","4.1.114.Final-tuxcare.2"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-classes-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.114.Final"},{"fixed":"4.1.114.Final-tuxcare.3"}]}],"versions":["4.1.114.Final","4.1.114.Final-tuxcare.1","4.1.114.Final-tuxcare.2"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.114.Final"},{"fixed":"4.1.114.Final-tuxcare.3"}]}],"versions":["4.1.114.Final","4.1.114.Final-tuxcare.1","4.1.114.Final-tuxcare.2"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.118.Final"},{"fixed":"4.1.118.Final-tuxcare.2"}]}],"versions":["4.1.118.Final","4.1.118.Final-tuxcare.1"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.118.Final"},{"fixed":"4.1.118.Final-tuxcare.2"}]}],"versions":["4.1.118.Final","4.1.118.Final-tuxcare.1"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.118.Final"},{"fixed":"4.1.118.Final-tuxcare.2"}]}],"versions":["4.1.118.Final","4.1.118.Final-tuxcare.1"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.118.Final"},{"fixed":"4.1.118.Final-tuxcare.2"}]}],"versions":["4.1.118.Final","4.1.118.Final-tuxcare.1"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.118.Final"},{"fixed":"4.1.118.Final-tuxcare.2"}]}],"versions":["4.1.118.Final","4.1.118.Final-tuxcare.1"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.12.Final"},{"fixed":"4.2.12.Final-tuxcare.2"}]}],"versions":["4.2.12.Final","4.2.12.Final-tuxcare.1"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.12.Final"},{"fixed":"4.2.12.Final-tuxcare.2"}]}],"versions":["4.2.12.Final","4.2.12.Final-tuxcare.1"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.12.Final"},{"fixed":"4.2.12.Final-tuxcare.2"}]}],"versions":["4.2.12.Final","4.2.12.Final-tuxcare.1"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.12.Final"},{"fixed":"4.2.12.Final-tuxcare.2"}]}],"versions":["4.2.12.Final","4.2.12.Final-tuxcare.1"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.12.Final"},{"fixed":"4.2.12.Final-tuxcare.2"}]}],"versions":["4.2.12.Final","4.2.12.Final-tuxcare.1"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-classes-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.12.Final"},{"fixed":"4.2.12.Final-tuxcare.2"}]}],"versions":["4.2.12.Final","4.2.12.Final-tuxcare.1"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.12.Final"},{"fixed":"4.2.12.Final-tuxcare.2"}]}],"versions":["4.2.12.Final","4.2.12.Final-tuxcare.1"],"bundled":10},{"source":"osv","ecosystem":"Debian:12","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-10","1:4.1.48-11","1:4.1.48-12","1:4.1.48-13","1:4.1.48-14","1:4.1.48-15","1:4.1.48-16","1:4.1.48-7","1:4.1.48-7+deb12u1","1:4.1.48-7+deb12u2","1:4.1.48-8","1:4.1.48-9"]},{"source":"osv","ecosystem":"Debian:13","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-10","1:4.1.48-10+deb13u1","1:4.1.48-11","1:4.1.48-12","1:4.1.48-13","1:4.1.48-14","1:4.1.48-15","1:4.1.48-16"]},{"source":"osv","ecosystem":"Debian:14","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-10","1:4.1.48-11","1:4.1.48-12","1:4.1.48-13","1:4.1.48-14","1:4.1.48-15","1:4.1.48-16"]},{"source":"osv","ecosystem":"Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0.Final"},{"fixed":"4.2.17.Final"}]}],"versions":["4.2.0.Final","4.2.1.Final","4.2.10.Final","4.2.11.Final","4.2.12.Final","4.2.13.Final","4.2.14.Final","4.2.15.Final","4.2.16.Final","4.2.2.Final","4.2.3.Final","4.2.4.Final","4.2.5.Final","4.2.6.Final","4.2.7.Final","4.2.8.Final","4.2.9.Final"]},{"source":"osv","ecosystem":"Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.137.Final"}]}],"versions":["4.0.0.Beta1","4.0.0.Beta2","4.0.0.Beta3","4.0.0.CR1","4.0.0.CR2","4.0.0.CR3","4.0.0.CR4","4.0.0.CR5","4.0.0.CR6","4.0.0.CR7","4.0.0.CR8","4.0.0.CR9","4.0.0.Final","4.0.1.Final","4.0.10.Final","4.0.11.Final","4.0.12.Final","4.0.13.Final","4.0.14.Beta1","4.0.14.Final","4.0.15.Final","4.0.16.Final","4.0.17.Final","4.0.18.Final","4.0.19.Final","4.0.2.Final","4.0.20.Final","4.0.21.Final","4.0.22.Final","4.0.23.Final","4.0.24.Final","4.0.25.Final","4.0.26.Final","4.0.27.Final","4.0.28.Final","4.0.29.Final","4.0.3.Final","4.0.30.Final","4.0.31.Final","4.0.32.Final","4.0.33.Final","4.0.34.Final","4.0.35.Final","4.0.36.Final","4.0.37.Final","4.0.38.Final","4.0.39.Final","4.0.4.Final","4.0.40.Final","4.0.41.Final","4.0.42.Final","4.0.43.Final","4.0.44.Final","4.0.45.Final","4.0.46.Final","4.0.47.Final","4.0.48.Final","4.0.49.Final","4.0.5.Final","4.0.50.Final","4.0.51.Final","4.0.52.Final","4.0.53.Final","4.0.54.Final","4.0.55.Final","4.0.56.Final","4.0.6.Final","4.0.7.Final","4.0.8.Final","4.0.9.Final","4.1.0.Beta1","4.1.0.Beta2","4.1.0.Beta3","4.1.0.Beta4","4.1.0.Beta5","4.1.0.Beta6","4.1.0.Beta7","4.1.0.Beta8","4.1.0.CR1","4.1.0.CR2","4.1.0.CR3","4.1.0.CR4","4.1.0.CR5","4.1.0.CR6","4.1.0.CR7","4.1.0.Final","4.1.1.Final","4.1.10.Final","4.1.100.Final","4.1.101.Final","4.1.102.Final","4.1.103.Final","4.1.104.Final","4.1.105.Final","4.1.106.Final","4.1.107.Final","4.1.108.Final","4.1.109.Final","4.1.11.Final","4.1.110.Final","4.1.111.Final","4.1.112.Final","4.1.113.Final","4.1.114.Final","4.1.115.Final","4.1.116.Final","4.1.117.Final","4.1.118.Final","4.1.119.Final","4.1.12.Final","4.1.120.Final","4.1.121.Final","4.1.122.Final","4.1.123.Final","4.1.124.Final","4.1.125.Final","4.1.126.Final","4.1.127.Final","4.1.128.Final","4.1.129.Final","4.1.13.Final","4.1.130.Final","4.1.131.Final","4.1.132.Final","4.1.133.Final","4.1.134.Final","4.1.135.Final","4.1.136.Final","4.1.14.Final","4.1.15.Final","4.1.16.Final","4.1.17.Final","4.1.18.Final","4.1.19.Final","4.1.2.Final","4.1.20.Final","4.1.21.Final","4.1.22.Final","4.1.23.Final","4.1.24.Final","4.1.25.Final","4.1.26.Final","4.1.27.Final","4.1.28.Final","4.1.29.Final","4.1.3.Final","4.1.30.Final","4.1.31.Final","4.1.32.Final","4.1.33.Final","4.1.34.Final","4.1.35.Final","4.1.36.Final","4.1.37.Final","4.1.38.Final","4.1.39.Final","4.1.4.Final","4.1.40.Final","4.1.41.Final","4.1.42.Final","4.1.43.Final","4.1.44.Final","4.1.45.Final","4.1.46.Final","4.1.47.Final","4.1.48.Final","4.1.49.Final","4.1.5.Final","4.1.50.Final","4.1.51.Final","4.1.52.Final","4.1.53.Final","4.1.54.Final","4.1.55.Final","4.1.56.Final","4.1.57.Final","4.1.58.Final","4.1.59.Final","4.1.6.Final","4.1.60.Final","4.1.61.Final","4.1.62.Final","4.1.63.Final","4.1.64.Final","4.1.65.Final","4.1.66.Final","4.1.67.Final","4.1.68.Final","4.1.69.Final","4.1.7.Final","4.1.70.Final","4.1.71.Final","4.1.72.Final","4.1.73.Final","4.1.74.Final","4.1.75.Final","4.1.76.Final","4.1.77.Final","4.1.78.Final","4.1.79.Final","4.1.8.Final","4.1.80.Final","4.1.81.Final","4.1.82.Final","4.1.83.Final","4.1.84.Final","4.1.85.Final","4.1.86.Final","4.1.87.Final","4.1.88.Final","4.1.89.Final","4.1.9.Final","4.1.90.Final","4.1.91.Final","4.1.92.Final","4.1.93.Final","4.1.94.Final","4.1.95.Final","4.1.96.Final","4.1.97.Final","4.1.98.Final","4.1.99.Final"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.100.Final-rhlw-00001"}]}],"versions":["4.0.0.Beta1","4.0.0.Beta2","4.0.0.Beta3","4.0.0.CR1","4.0.0.CR2","4.0.0.CR3","4.0.0.CR4","4.0.0.CR5","4.0.0.CR6","4.0.0.CR7","4.0.0.CR8","4.0.0.CR9","4.0.0.Final","4.0.1.Final","4.0.10.Final","4.0.11.Final","4.0.12.Final","4.0.13.Final","4.0.14.Beta1","4.0.14.Final","4.0.15.Final","4.0.16.Final","4.0.17.Final","4.0.18.Final","4.0.19.Final","4.0.2.Final","4.0.20.Final","4.0.21.Final","4.0.22.Final","4.0.23.Final","4.0.24.Final","4.0.25.Final","4.0.26.Final","4.0.27.Final","4.0.28.Final","4.0.29.Final","4.0.3.Final","4.0.30.Final","4.0.31.Final","4.0.32.Final","4.0.33.Final","4.0.34.Final","4.0.35.Final","4.0.36.Final","4.0.37.Final","4.0.38.Final","4.0.39.Final","4.0.4.Final","4.0.40.Final","4.0.41.Final","4.0.42.Final","4.0.43.Final","4.0.44.Final","4.0.45.Final","4.0.46.Final","4.0.47.Final","4.0.48.Final","4.0.49.Final","4.0.5.Final","4.0.50.Final","4.0.51.Final","4.0.52.Final","4.0.53.Final","4.0.54.Final","4.0.55.Final","4.0.56.Final","4.0.6.Final","4.0.7.Final","4.0.8.Final","4.0.9.Final","4.1.0.Beta1","4.1.0.Beta2","4.1.0.Beta3","4.1.0.Beta4","4.1.0.Beta5","4.1.0.Beta6","4.1.0.Beta7","4.1.0.Beta8","4.1.0.CR1","4.1.0.CR2","4.1.0.CR3","4.1.0.CR4","4.1.0.CR5","4.1.0.CR6","4.1.0.CR7","4.1.0.Final","4.1.1.Final","4.1.10.Final","4.1.100.Final","4.1.11.Final","4.1.12.Final","4.1.13.Final","4.1.14.Final","4.1.15.Final","4.1.16.Final","4.1.17.Final","4.1.18.Final","4.1.19.Final","4.1.2.Final","4.1.20.Final","4.1.21.Final","4.1.22.Final","4.1.23.Final","4.1.24.Final","4.1.25.Final","4.1.26.Final","4.1.27.Final","4.1.28.Final","4.1.29.Final","4.1.3.Final","4.1.30.Final","4.1.31.Final","4.1.32.Final","4.1.33.Final","4.1.34.Final","4.1.35.Final","4.1.36.Final","4.1.37.Final","4.1.38.Final","4.1.39.Final","4.1.4.Final","4.1.40.Final","4.1.41.Final","4.1.42.Final","4.1.43.Final","4.1.44.Final","4.1.45.Final","4.1.46.Final","4.1.47.Final","4.1.48.Final","4.1.49.Final","4.1.5.Final","4.1.50.Final","4.1.51.Final","4.1.52.Final","4.1.53.Final","4.1.54.Final","4.1.55.Final","4.1.56.Final","4.1.57.Final","4.1.58.Final","4.1.59.Final","4.1.6.Final","4.1.60.Final","4.1.61.Final","4.1.62.Final","4.1.63.Final","4.1.64.Final","4.1.65.Final","4.1.66.Final","4.1.67.Final","4.1.68.Final","4.1.69.Final","4.1.7.Final","4.1.70.Final","4.1.71.Final","4.1.72.Final","4.1.73.Final","4.1.74.Final","4.1.75.Final","4.1.76.Final","4.1.77.Final","4.1.78.Final","4.1.79.Final","4.1.8.Final","4.1.80.Final","4.1.81.Final","4.1.82.Final","4.1.83.Final","4.1.84.Final","4.1.85.Final","4.1.86.Final","4.1.87.Final","4.1.88.Final","4.1.89.Final","4.1.9.Final","4.1.90.Final","4.1.91.Final","4.1.92.Final","4.1.93.Final","4.1.94.Final","4.1.95.Final","4.1.96.Final","4.1.97.Final","4.1.98.Final","4.1.99.Final"],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.84-150200.3.51.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.138-150200.4.56.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.84-150200.3.51.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.84-150200.3.51.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.84-150200.3.51.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.84-150200.3.51.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.84-150200.3.51.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.84-150200.3.51.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.84-150200.3.51.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.84-150200.3.51.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.84-150200.3.51.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.84-150200.3.51.1"}]}],"bundled":30},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.2.6.Final-2","1:3.2.6.Final-2+deb8u2build0.14.04.1~esm1","1:3.2.6.Final-2+deb8u2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.2.6.Final-2","1:4.0.32-1","1:4.0.33-1","1:4.0.34-1","1:4.0.34-1ubuntu0.1~esm1","1:4.0.34-1ubuntu0.1~esm2","1:4.0.34-1ubuntu0.1~esm3","1:4.0.34-1ubuntu0.1~esm4","1:4.0.34-1ubuntu0.1~esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.7-4","1:4.1.7-4ubuntu0.1~esm1","1:4.1.7-4ubuntu0.1","1:4.1.7-4ubuntu0.1+esm1","1:4.1.7-4ubuntu0.1+esm2","1:4.1.7-4ubuntu0.1+esm3","1:4.1.7-4ubuntu0.1+esm4","1:4.1.7-4ubuntu0.1+esm5","1:4.1.7-4ubuntu0.1+esm6","1:4.1.7-4ubuntu0.1+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.33-1","1:4.1.33-2","1:4.1.33-3","1:4.1.45-1","1:4.1.45-1ubuntu0.1~esm1","1:4.1.45-1ubuntu0.1~esm2","1:4.1.45-1ubuntu0.1~esm3","1:4.1.45-1ubuntu0.1~esm4","1:4.1.45-1ubuntu0.1~esm6","1:4.1.45-1ubuntu0.1~esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-4","1:4.1.48-4+deb11u1build0.22.04.1","1:4.1.48-4+deb11u2build0.22.04.1","1:4.1.48-4+deb11u2ubuntu0.1~esm1","1:4.1.48-4+deb11u2ubuntu0.1~esm2","1:4.1.48-4+deb11u2ubuntu0.1","1:4.1.48-4+deb11u2ubuntu0.1+esm1","1:4.1.48-4+deb11u2ubuntu0.1+esm3","1:4.1.48-4+deb11u2ubuntu0.2","1:4.1.48-4+deb11u2ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-7","1:4.1.48-8","1:4.1.48-9","1:4.1.48-9ubuntu0.1~esm1","1:4.1.48-9ubuntu0.1~esm2","1:4.1.48-9ubuntu0.1","1:4.1.48-9ubuntu0.1+esm1","1:4.1.48-9ubuntu0.1+esm3","1:4.1.48-9ubuntu0.2","1:4.1.48-9ubuntu0.2+esm1","1:4.1.48-9ubuntu0.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-16","1:4.1.48-16ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-10","1:4.1.48-11","1:4.1.48-12","1:4.1.48-13","1:4.1.48-14","1:4.1.48-16","1:4.1.48-16ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.138-1.1"}]}],"bundled":30}],"products":[{"vendor":"netty","product":"netty"}],"references":[{"url":"https://github.com/netty/netty/security/advisories/GHSA-2qj4-mmr9-4v2f","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://github.com/netty/netty/pull/17213","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","web"]},{"url":"https://github.com/netty/netty/pull/17217","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","web"]},{"url":"https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://github.com/netty/netty/releases/tag/netty-4.2.17.Final","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://github.com/advisories/GHSA-2qj4-mmr9-4v2f","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59902.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59902","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-59902","tags":["advisory"]},{"url":"https://github.com/netty/netty","tags":["package"]},{"url":"https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","tags":["web"]},{"url":"https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","tags":["web"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46340.json","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:37390","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:41951","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50085","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53644","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53645","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53646","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-46340","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46340.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-5xrh-qmmq-w6ch","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46340","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5xrh-qmmq-w6ch","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264391-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1275500","tags":["report"]},{"url":"https://bugzilla.suse.com/1275501","tags":["report"]},{"url":"https://bugzilla.suse.com/1276420","tags":["report"]},{"url":"https://bugzilla.suse.com/1276421","tags":["report"]},{"url":"https://bugzilla.suse.com/1276455","tags":["report"]},{"url":"https://bugzilla.suse.com/1276456","tags":["report"]},{"url":"https://bugzilla.suse.com/1277243","tags":["report"]},{"url":"https://bugzilla.suse.com/1280048","tags":["report"]},{"url":"https://bugzilla.suse.com/1281431","tags":["report"]},{"url":"https://bugzilla.suse.com/1281432","tags":["report"]},{"url":"https://bugzilla.suse.com/1281433","tags":["report"]},{"url":"https://bugzilla.suse.com/1281434","tags":["report"]},{"url":"https://bugzilla.suse.com/1281435","tags":["report"]},{"url":"https://bugzilla.suse.com/1282084","tags":["report"]},{"url":"https://bugzilla.suse.com/1282085","tags":["report"]},{"url":"https://bugzilla.suse.com/1282132","tags":["report"]},{"url":"https://bugzilla.suse.com/1282140","tags":["report"]},{"url":"https://bugzilla.suse.com/1282141","tags":["report"]},{"url":"https://bugzilla.suse.com/1282362","tags":["report"]},{"url":"https://bugzilla.suse.com/1282363","tags":["report"]},{"url":"https://bugzilla.suse.com/1282364","tags":["report"]},{"url":"https://bugzilla.suse.com/1282366","tags":["report"]},{"url":"https://bugzilla.suse.com/1282367","tags":["report"]},{"url":"https://bugzilla.suse.com/1282370","tags":["report"]},{"url":"https://bugzilla.suse.com/1282372","tags":["report"]},{"url":"https://bugzilla.suse.com/1282373","tags":["report"]},{"url":"https://bugzilla.suse.com/1282374","tags":["report"]},{"url":"https://bugzilla.suse.com/1282378","tags":["report"]},{"url":"https://bugzilla.suse.com/1282506","tags":["report"]},{"url":"https://bugzilla.suse.com/1282507","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75596","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89044","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93488","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93491","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93492","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93493","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93560","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93562","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93564","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93565","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93567","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93568","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93573","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93574","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93575","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93576","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93578","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93579","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-59902","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59902","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-59902","title":"Netty: Memory Exhaustion in SctpMessageCompletionHandler","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with large SCTP fragments. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.","status":"published","published":"2026-08-17T17:48:55.663Z","modified":"2026-08-18T14:50:42.964Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:19:58.560602Z"}],"euvd":[{"id":"EUVD-2026-60314","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with large SCTP fragments. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.","status":"published","published":"2026-08-17T17:48:55Z","modified":"2026-08-18T14:50:42Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:01:46.762528Z"}],"ghsa":[{"id":"GHSA-2qj4-mmr9-4v2f","title":"Netty: Memory Exhaustion in SctpMessageCompletionHandler","description":"### Summary\nSctpMessageCompletionHandler does not limit the total size of buffered fragments, allowing an unauthenticated attacker to cause an OutOfMemoryError by sending large SCTP fragments.\n\n### Details\n`io.netty.handler.codec.sctp.SctpMessageCompletionHandler` buffers fragments for incomplete SCTP messages. The fix for CVE-2026-46340 fixed unbounded memory growth by introducing limits on the number of concurrent incomplete messages (maxIncompleteSctpMessages) and the number of fragments per message (maxFragments).\n\nWhile the count of fragments is now bounded, the handler still does not enforce a maximum size in bytes.\n\nWith the default limits of 128 messages and 128 fragments, and a typical max SCTP chunk size of 64KB, an attacker can consume up to ~1GB per connection. By opening a small number of concurrent connections, an attacker can easily exhaust the server's memory, causing an OutOfMemoryError.\n\n### Impact\nMemory Exhaustion. Any application using Netty's SCTP transport with SctpMessageCompletionHandler is impacted.","status":"published","published":"2026-08-17T17:50:49Z","modified":"2026-08-17T17:50:49Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:41:01.23108Z"}],"nvd":[{"id":"CVE-2026-59902","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with large SCTP fragments. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.","status":"published","published":"2026-08-17T18:17:36.087Z","modified":"2026-09-23T15:31:54.467Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:12:38.647684Z"}],"osv":[{"id":"CVE-2026-59902","title":"Netty: Memory Exhaustion in SctpMessageCompletionHandler","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with large SCTP fragments. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.","status":"published","published":"2026-08-17T17:48:55.663Z","modified":"2026-10-28T11:18:13.872226669Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:45:12.496548Z"},{"id":"DEBIAN-CVE-2026-59902","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with large SCTP fragments. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.","status":"published","published":"2026-08-17T18:17:36.087Z","modified":"2026-09-24T08:47:33.083199786Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:57.932517Z"},{"id":"GHSA-2qj4-mmr9-4v2f","title":"Netty: Memory Exhaustion in SctpMessageCompletionHandler","description":"### Summary\nSctpMessageCompletionHandler does not limit the total size of buffered fragments, allowing an unauthenticated attacker to cause an OutOfMemoryError by sending large SCTP fragments.\n\n### Details\n`io.netty.handler.codec.sctp.SctpMessageCompletionHandler` buffers fragments for incomplete SCTP messages. The fix for CVE-2026-46340 fixed unbounded memory growth by introducing limits on the number of concurrent incomplete messages (maxIncompleteSctpMessages) and the number of fragments per message (maxFragments).\n\nWhile the count of fragments is now bounded, the handler still does not enforce a maximum size in bytes.\n\nWith the default limits of 128 messages and 128 fragments, and a typical max SCTP chunk size of 64KB, an attacker can consume up to ~1GB per connection. By opening a small number of concurrent connections, an attacker can easily exhaust the server's memory, causing an OutOfMemoryError.\n\n### Impact\nMemory Exhaustion. Any application using Netty's SCTP transport with SctpMessageCompletionHandler is impacted.","status":"published","published":"2026-08-17T17:50:49Z","modified":"2026-09-10T03:51:12.91620653Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:34.700741Z"},{"id":"RHLW-2026-4140a7a9c48db376","title":"Lightwell Security Advisory: netty-transport-sctp 4.1.100.Final-rhlw-00001","description":"Red Hat Lightwell has released io.netty:netty-transport-sctp 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2026-46340 and CVE-2026-59902.\n\nCVE-2026-46340: Netty: SCTP reassembly nests buffers without bound\n\nCVE-2026-59902: Netty: Memory Exhaustion in SctpMessageCompletionHandler\n\nThis patched artifact is a drop-in replacement for io.netty:netty-transport-sctp 4.1.100.Final from Maven Central.","status":"published","published":"2026-10-12T16:58:34Z","modified":"2026-10-27T04:12:59.742120808Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"UBUNTU-CVE-2026-59902","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with large SCTP fragments. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.","status":"published","published":"2026-08-17T18:17:00Z","modified":"2026-10-17T12:59:14.517137792Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:41.911783Z"},{"id":"CLSA-2026-1788874301","title":"TuxCare security update for io.netty:netty-transport-sctp (1 CVE)","description":"TuxCare rebuilt io.netty:netty-transport-sctp to address 1 CVE. Fixed in 4.1.122.Final-tuxcare.3.","status":"published","published":"2026-09-08T13:31:41Z","modified":"2026-11-02T19:46:10.105161839Z","updated_at":"2026-11-02T20:29:40.716173Z"},{"id":"CLSA-2026-1789142484","title":"TuxCare security update for io.netty (4 CVEs)","description":"TuxCare rebuilt 4 io.netty packages to address 4 CVEs. Fixed in 4.1.94.Final-tuxcare.2.","status":"published","published":"2026-09-11T16:01:24Z","modified":"2026-11-02T19:46:13.51642909Z","updated_at":"2026-11-02T20:29:35.589477Z"},{"id":"CLSA-2026-1789146166","title":"TuxCare security update for io.netty:netty-transport-sctp (1 CVE)","description":"TuxCare rebuilt io.netty:netty-transport-sctp to address 1 CVE. Fixed in 4.1.119.Final-tuxcare.2.","status":"published","published":"2026-09-11T17:02:46Z","modified":"2026-11-02T19:46:12.329261294Z","updated_at":"2026-11-02T20:29:40.716173Z"},{"id":"CLSA-2026-1789211588","title":"TuxCare security update for io.netty:netty-transport-sctp (1 CVE)","description":"TuxCare rebuilt io.netty:netty-transport-sctp to address 1 CVE. Fixed in 4.1.111.Final-tuxcare.2.","status":"published","published":"2026-09-12T11:13:08Z","modified":"2026-11-02T19:46:13.036630397Z","updated_at":"2026-11-02T20:29:35.589477Z"},{"id":"CLSA-2026-1789219941","title":"TuxCare security update for io.netty:netty-transport-sctp (1 CVE)","description":"TuxCare rebuilt io.netty:netty-transport-sctp to address 1 CVE. Fixed in 4.1.117.Final-tuxcare.4.","status":"published","published":"2026-09-12T13:32:21Z","modified":"2026-11-02T19:46:15.127861478Z","updated_at":"2026-11-02T20:29:33.792105Z"},{"id":"CLSA-2026-1789219944","title":"TuxCare security update for io.netty (2 CVEs)","description":"TuxCare rebuilt 2 io.netty packages to address 2 CVEs. Fixed in 4.1.108.Final-tuxcare.2.","status":"published","published":"2026-09-12T13:32:24Z","modified":"2026-11-02T19:46:15.15620281Z","updated_at":"2026-11-02T20:29:33.792105Z"},{"id":"CLSA-2026-1789387099","title":"TuxCare security update for io.netty (9 CVEs)","description":"TuxCare rebuilt 8 io.netty packages to address 9 CVEs. Fixed in 4.1.93.Final-tuxcare.4.","status":"published","published":"2026-09-14T11:58:19Z","modified":"2026-11-02T19:46:15.892490015Z","updated_at":"2026-11-02T20:29:33.792105Z"},{"id":"CLSA-2026-1790853416","title":"TuxCare security update for io.netty (4 CVEs)","description":"TuxCare rebuilt 4 io.netty packages to address 4 CVEs. Fixed in 4.1.107.Final-tuxcare.2.","status":"published","published":"2026-10-01T11:16:56Z","modified":"2026-11-02T19:46:24.40844444Z","updated_at":"2026-11-02T20:29:22.637147Z"},{"id":"CLSA-2026-1792115780","title":"TuxCare security update for io.netty (9 CVEs)","description":"TuxCare rebuilt 8 io.netty packages to address 9 CVEs. Fixed in 4.1.115.Final-tuxcare.9.","status":"published","published":"2026-10-16T01:56:20Z","modified":"2026-11-02T19:46:29.392948514Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792666293","title":"TuxCare security update for io.netty (17 CVEs)","description":"TuxCare rebuilt 8 io.netty packages to address 17 CVEs. Fixed in 4.1.128.Final-tuxcare.1.","status":"published","published":"2026-10-22T10:51:33Z","modified":"2026-11-02T19:46:30.622223878Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793707066","title":"TuxCare security update for io.netty (13 CVEs)","description":"TuxCare rebuilt 9 io.netty packages to address 13 CVEs. Fixed in 4.1.113.Final-tuxcare.2.","status":"published","published":"2026-11-03T12:57:47Z","modified":"2026-11-03T19:30:06.372744869Z","updated_at":"2026-11-03T20:03:57.215693Z"},{"id":"CLSA-2026-1793709318","title":"TuxCare security update for io.netty (12 CVEs)","description":"TuxCare rebuilt 8 io.netty packages to address 12 CVEs. Fixed in 4.1.101.Final-tuxcare.2.","status":"published","published":"2026-11-03T13:35:18Z","modified":"2026-11-03T19:30:03.804072784Z","updated_at":"2026-11-03T20:03:57.215693Z"},{"id":"CLSA-2026-1793711679","title":"TuxCare security update for io.netty (12 CVEs)","description":"TuxCare rebuilt 7 io.netty packages to address 12 CVEs. Fixed in 4.2.2.Final-tuxcare.2.","status":"published","published":"2026-11-03T14:14:40Z","modified":"2026-11-03T19:30:04.859031066Z","updated_at":"2026-11-03T20:03:57.215693Z"},{"id":"CLSA-2026-1793728348","title":"TuxCare security update for io.netty (4 CVEs)","description":"TuxCare rebuilt 3 io.netty packages to address 4 CVEs. Fixed in 4.1.96.Final-tuxcare.2.","status":"published","published":"2026-11-03T18:52:29Z","modified":"2026-11-04T02:30:03.775984437Z","updated_at":"2026-11-04T02:55:01.518827Z"},{"id":"CLSA-2026-1793731803","title":"TuxCare security update for io.netty (10 CVEs)","description":"TuxCare rebuilt 6 io.netty packages to address 10 CVEs. Fixed in 4.1.100.Final-tuxcare.2.","status":"published","published":"2026-11-03T19:50:04Z","modified":"2026-11-04T02:30:04.093988695Z","updated_at":"2026-11-04T02:55:01.518827Z"},{"id":"CLSA-2026-1793781915","title":"TuxCare security update for io.netty (7 CVEs)","description":"TuxCare rebuilt 6 io.netty packages to address 7 CVEs. Fixed in 4.1.99.Final-tuxcare.3.","status":"published","published":"2026-11-04T09:45:15Z","modified":"2026-11-04T14:45:06.682293599Z","updated_at":"2026-11-04T15:03:54.132276Z"},{"id":"CLSA-2026-1793864924","title":"TuxCare security update for io.netty (11 CVEs)","description":"TuxCare rebuilt 8 io.netty packages to address 11 CVEs. Fixed in 4.1.114.Final-tuxcare.3.","status":"published","published":"2026-11-05T08:48:45Z","modified":"2026-11-05T13:15:02.299097462Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793866195","title":"TuxCare security update for io.netty (9 CVEs)","description":"TuxCare rebuilt 5 io.netty packages to address 9 CVEs. Fixed in 4.1.118.Final-tuxcare.2.","status":"published","published":"2026-11-05T09:09:56Z","modified":"2026-11-05T13:15:04.990258889Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1794232233","title":"TuxCare security update for io.netty (10 CVEs)","description":"TuxCare rebuilt 7 io.netty packages to address 10 CVEs. Fixed in 4.2.12.Final-tuxcare.2.","status":"published","published":"2026-11-09T14:50:34Z","modified":"2026-11-09T19:15:14.084050771Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"openSUSE-SU-2026:11882-1","title":"netty-4.1.138-1.1 on GA media","description":"These are all security issues fixed in the netty-4.1.138-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-24T00:00:00Z","modified":"2026-09-25T18:23:09.573141425Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"SUSE-SU-2026:4391-1","title":"Security update for netty, netty-tcnative","description":"This update for netty, netty-tcnative fixes the following issues:\n\n- CVE-2026-59902: Netty: Memory Exhaustion in SctpMessageCompletionHandler (bsc#1275501).\n- CVE-2026-59903: Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite\n  (bsc#1275500).\n- CVE-2026-62243: TLS hostname verification bypass in Netty OpenSSL client path (bsc#1276455).\n- CVE-2026-62380: null byte and CRLF injection in Socks4ClientEncoder and Socks5ClientEncoder (bsc#1276456).\n- CVE-2026-75595: fragmented TLS `ClientHello` causes fallback to default `SslContext` and allows for SNI routing and\n  mTLS requirement bypass (bsc#1276420).\n- CVE-2026-75596: fragmented `ClientHello`records can trigger quadratic pre-handshake reassembly in default SNI parsing\n  (bsc#1276421).\n- CVE-2026-76816: missing input validation in `MqttEncoder` allows for null-byte injection, topic hijacking, and ACL\n  bypassing (bsc#1277243).\n- CVE-2026-89044: HTTP request smuggling in Netty via improper validation of final Transfer-Encoding coding\n  (bsc#1280048).\n- CVE-2026-93488: Denial of Service via unbounded concurrent SPDY streams (bsc#1282084).\n- CVE-2026-93491: Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue (bsc#1282085).\n- CVE-2026-93492: HTTP/2 HpackEncoder DoS with large table size (bsc#1282132).\n- CVE-2026-93493: missing `nextUpdate` field in OCSP responses leads to silent validation bypass (bsc#1281431).\n- CVE-2026-93494: ByteBuf Leak in StompSubframeDecoder When a Frame Body Is Never Terminated (bsc#1282506).\n- CVE-2026-93558: Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service\n  (bsc#1282140).\n- CVE-2026-93560: STOMP codec content-length long-to-int truncation causes infinite decode loop DoS (bsc#1282141).\n- CVE-2026-93562: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling (bsc#1282362).\n- CVE-2026-93563: unbounded multi-line response accumulation in `SmtpResponseDecoder` leads to memory exhaustion and a\n  DoS (bsc#1281432).\n- CVE-2026-93564: HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (bsc#1282363).\n- CVE-2026-93565: RtspDecoder Method-Token Smuggling via Trailing Control Byte (bsc#1282364).\n- CVE-2026-93566: HTTP Request Smuggling due to control characters in the chunk-size line (bsc#1282366).\n- CVE-2026-93567: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled\n  :authority (bsc#1282367).\n- CVE-2026-93568: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests (bsc#1282370).\n- CVE-2026-93569: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target\n  authority (bsc#1282372).\n- CVE-2026-93572: multiplication of patched preallocation limits in `RedisArrayAggregator` nested RESP headers can lead\n  to denial of service (bsc#1281433).\n- CVE-2026-93573: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling (bsc#1282373).\n- CVE-2026-93574: HTTP request smuggling via post-digit whitespace in chunk-size parsing (bsc#1282374).\n- CVE-2026-93575: missing validations in the `MqttDecoder` can lead to excessive resource consumption and a DoS\n  (bsc#1281434).\n- CVE-2026-93576: netty-codec-smtp -- SMTP command-name field is not CRLF-validated (bsc#1282507).\n- CVE-2026-93578: missing Extended Key Usage (EKU) check in OCSP client allows certificate revocation bypass\n  (bsc#1281435).\n- CVE-2026-93579: HTTP/2 header field values are not validated by default (bsc#1282378).\n\nChanges for netty:\n\n- Upgrade to upstream version 4.1.138\n\nChanges for netty-tcnative:\n\n- Upgrade to version 2.0.84 Final\n","status":"published","published":"2026-09-29T11:47:41Z","modified":"2026-09-30T12:00:04.604890726Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}