CVE and update status of the FreeBSD ports tree4,526 unaddressed CVEs in 616 portsAll times are CET

CVE details

CVE-2026-59902

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with large SCTP fragments. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.

Score
7.5 high
Published
2026-08-17
Links
NVD · cve.org

Affected ports (1)

PortPackageVersionStatusMaintainer
java/nettynetty4.1.53_2unaddressedglewis@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>netty</name>
	<range><lt>4.1.137</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Netty is an asynchronous, event-driven network application framework.
	Prior to 4.1.137.Final and 4.2.17.Final,
	io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits
	incomplete messages and fragment counts but not maxBufferedBytes,
	allowing unauthenticated peers to exhaust memory with large SCTP
	fragments. This issue is fixed in versions 4.1.137.Final and
	4.2.17.Final.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-59902</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-59902</url>
    </references>
    <dates>
      <discovery>2026-08-17</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>