7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-46340

CVE-2026-46340: Netty: SCTP reassembly nests buffers without bound

Netty is a network application framework for development of protocol servers and clients. In versions of netty-transport-sctp prior to 4.1.135.Final and 4.2.15.Final, for each non-complete SctpMessage fragment the handler does fragments.put(streamId, Unpooled.wrappedBuffer(frag, byteBuf)), wrapping the previous accumulator and the new slice into a new CompositeByteBuf every time. After N fragments the accumulator is an N-deep chain of composites, each holding references and component arrays; readableBytes()/getBytes() on the final buffer recurse N levels. There is no limit on N, on total bytes, or on the number of streamIdentifiers an attacker can open (each gets its own map entry). A peer that never sets the complete flag can grow this structure indefinitely from tiny 1-byte DATA chunks. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-46340

CVE-2026-46340:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
io.netty:netty-transport-sctp	maven	>= 4.2.0.Final, <= 4.2.14.Final	4.2.15.Final
io.netty:netty-transport-sctp	maven	<= 4.1.134.Final	4.1.135.Final

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, described as 'SCTP reassembly nests buffers without bound', is caused by the SctpMessageCompletionHandler recursively wrapping byte buffers for fragmented SCTP messages. The analysis of the provided patch commits confirms this. The key commit ccea858edd35a3234fdb09808d09b0228e62fc25 modifies the decode method within io.netty.handler.codec.sctp.SctpMessageCompletionHandler. The vulnerable code, which was removed, used Unpooled.wrappedBuffer(frag, byteBuf) to append new fragments. This operation creates a new CompositeByteBuf that holds a reference to the previous buffer and the new one, leading to a deep nesting of buffers if many fragments are received for the same stream without the 'complete' flag. This unbounded nesting could lead to a stack overflow during buffer operations or excessive memory usage, resulting in a denial of service. The identified vulnerable function, io.netty.handler.codec.sctp.SctpMessageCompletionHandler.decode, is the exact location where this flawed logic existed. The patch replaces this recursive wrapping with a list-based aggregation of fragments and introduces configurable limits on the number of incomplete messages and fragments, mitigating the vulnerability.

Vulnerable functions

io.netty.handler.codec.sctp.SctpMessageCompletionHandler.decode

transport-sctp/src/main/java/io/netty/handler/codec/sctp/SctpMessageCompletionHandler.java

The `decode` method in `SctpMessageCompletionHandler` was vulnerable to a resource exhaustion attack. For each incomplete SCTP message fragment, it would wrap the existing buffer and the new fragment in a new `CompositeByteBuf` using `Unpooled.wrappedBuffer()`. This created a deeply nested chain of buffers. An attacker could send a large number of tiny, incomplete fragments, causing the application to consume excessive memory, leading to a denial of service. The patch fixes this by collecting fragments in a list and creating a single composite buffer only when the message is complete, while also adding limits to the number of incomplete messages and fragments allowed.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.