A flaw in Netty’s SctpMessageCompletionHandler allows an attacker to send unbounded SCTP fragments. The handler limits incomplete messages and fragment counts but does not enforce a maximum on buffered bytes, so an unauthenticated peer can cause the application to allocate excessive memory, potentially exhausting system resources. The vulnerability is classified under CWE-400 and can lead to a disruption of service when exhausted memory cannot be reclaimed.

The issue affects Netty versions prior to 4.1.137.Final and 4.2.17.Final. Systems that use the netty:netty library with SctpMessageCompletionHandler unpatched are vulnerable.

The CVSS score of 7.5 indicates a high severity, while no EPSS score is available and the vulnerability is not yet listed in CISA’s KEV catalog. The likely attack vector is a remote, unauthenticated client that transmits a large number of SCTP fragments to a Netty application over the network. If exploited, the attacker can trigger severe memory exhaustion, resulting in application crashes or forced restarts, thereby denying legitimate traffic.