Listen to this Post
io.netty.handler.codec.sctp.SctpMessageCompletionHandler is responsible for reassembling fragmented SCTP messages in Netty’s SCTP transport. When an SCTP message arrives in fragments, the handler buffers these fragments until the complete flag is set, at which point the full message is delivered upstream.
The handler was previously vulnerable to unbounded memory growth (CVE-2026-46340), where each fragment would wrap the existing accumulator into a new CompositeByteBuf, creating an N-deep chain of composites. The fix for CVE-2026-46340 introduced two limits: `maxIncompleteSctpMessages` (default 128) to limit concurrent incomplete messages, and `maxFragments` (default 128) to limit fragments per message.
However, the fix addressed only the count of fragments, not their total byte size. The handler still does not enforce any maximum size in bytes for buffered fragments. With the default limits of 128 messages and 128 fragments, and a typical maximum SCTP chunk size of 64KB, an attacker can consume up to approximately 1GB of memory per connection (128 × 128 × 64KB). By opening a small number of concurrent connections, an attacker can easily exhaust the server’s heap memory, triggering an OutOfMemoryError and causing a denial of service.
The vulnerability exists in netty-transport-sctp versions prior to 4.1.137.Final and 4.2.17.Final. It is fixed in versions 4.1.137.Final and 4.2.17.Final.
DailyCVE Form:
Platform: Netty SCTP
Version: <4.1.137, <4.2.17
Vulnerability: Memory Exhaustion
Severity: High (7.5 CVSS)
date: 2026-08-17
Prediction: Patch already available
What Undercode Say:
Check Netty SCTP version in your project mvn dependency:tree | grep netty-transport-sctp For Gradle gradle dependencies | grep netty-transport-sctp Check running processes for SCTP usage lsof -i | grep sctp Monitor memory usage of Java process jstat -gc $(pgrep -f "netty") 1s
// Vulnerable code pattern in SctpMessageCompletionHandler // Each fragment wraps previous accumulator into new CompositeByteBuf fragments.put(streamId, Unpooled.wrappedBuffer(frag, byteBuf)); // No limit on total bytes - allows memory exhaustion
Exploit: (Educational Purposes!)
// Attacker sends SCTP DATA chunks with complete flag = false
// Each chunk can be up to 64KB (max SCTP chunk size)
// With default limits: 128 messages × 128 fragments × 64KB = ~1GB per connection
// Pseudo-code for attack:
SctpChannel channel = connect(target);
for (int msgId = 0; msgId < 129; msgId++) {
for (int fragId = 0; fragId < 129; fragId++) {
sendDataChunk(channel, msgId, fragId, false, 64KB_data);
}
}
// Result: ~1GB buffered per connection
// Open 10 connections → ~10GB memory exhaustion
Protection:
- Upgrade to Netty 4.1.137.Final or 4.2.17.Final or later
- If unable to upgrade, override default limits by setting lower `maxIncompleteSctpMessages` and `maxFragments` values
- Implement rate limiting on incoming SCTP connections and fragments
- Monitor JVM heap usage and set appropriate `-Xmx` limits with headroom
- Consider disabling SCTP transport if not required for your application
Impact:
- Confidentiality: None
- Integrity: None
- Availability: High – Unauthenticated remote attacker can cause complete denial of service via OutOfMemoryError
- Any application using Netty’s SCTP transport with SctpMessageCompletionHandler is impacted
- Affects all versions prior to 4.1.137.Final and 4.2.17.Final
- Publicly accessible services are at highest risk
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
