io.netty:netty-transport-sctp 4.2.7.Final

Direct Vulnerabilities

Known vulnerabilities in the io.netty:netty-transport-sctp package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Improperly Controlled Sequential Memory Allocation Affected versions of this package are vulnerable to Improperly Controlled Sequential Memory Allocation due to unbounded buffering of incomplete SCTP message fragments. An attacker can trigger an `OutOfMemoryError` by sending large or many fragmented SCTP messages that the handler retains while waiting for completion. The handler limits fragment counts, but it does not cap the total bytes held across incomplete messages, so a small number of concurrent connections can accumulate enough buffered data to exhaust server memory and disrupt applications using Netty’s SCTP transport. How to fix Improperly Controlled Sequential Memory Allocation? Upgrade `io.netty:netty-transport-sctp` to version 4.1.137.Final, 4.2.17.Final or higher.	[,4.1.137.Final)[4.2.0.Final,4.2.17.Final)
H Allocation of Resources Without Limits or Throttling Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to unbounded nesting of composite buffers in the SCTP message reassembly process. An attacker can exhaust system memory and cause a denial of service by sending a large number of incomplete message fragments, each creating deeper buffer chains without limit. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `io.netty:netty-transport-sctp` to version 4.1.135.Final, 4.2.15.Final or higher.	[,4.1.135.Final)[4.2.0.Final,4.2.15.Final)

Vulnerability

Vulnerable Version

Improperly Controlled Sequential Memory Allocation

Affected versions of this package are vulnerable to Improperly Controlled Sequential Memory Allocation due to unbounded buffering of incomplete SCTP message fragments. An attacker can trigger an OutOfMemoryError by sending large or many fragmented SCTP messages that the handler retains while waiting for completion. The handler limits fragment counts, but it does not cap the total bytes held across incomplete messages, so a small number of concurrent connections can accumulate enough buffered data to exhaust server memory and disrupt applications using Netty’s SCTP transport.

How to fix Improperly Controlled Sequential Memory Allocation?

Upgrade io.netty:netty-transport-sctp to version 4.1.137.Final, 4.2.17.Final or higher.

[,4.1.137.Final)[4.2.0.Final,4.2.17.Final)

Allocation of Resources Without Limits or Throttling

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to unbounded nesting of composite buffers in the SCTP message reassembly process. An attacker can exhaust system memory and cause a denial of service by sending a large number of incomplete message fragments, each creating deeper buffer chains without limit.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade io.netty:netty-transport-sctp to version 4.1.135.Final, 4.2.15.Final or higher.

[,4.1.135.Final)[4.2.0.Final,4.2.15.Final)

io.netty:netty-transport-sctp@4.2.7.Final

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically