CVE-2026-46340

About vulnerability

For each non-complete SctpMessage fragment the handler does fragments.put(streamId, Unpooled.wrappedBuffer(frag, byteBuf)), wrapping the previous accumulator and the new slice into a new CompositeByteBuf every time. After N fragments the accumulator is an N-deep chain of composites, each holding references and component arrays; readableBytes()/getBytes() on the final buffer recurse N levels. There is no limit on N, on total bytes, or on the number of streamIdentifiers an attacker can open (each gets its own map entry). A peer that never sets the complete flag can grow this structure indefinitely from tiny 1-byte DATA chunks.

Affected product:

Apache CXF , Apache Hadoop , Apache Kafka , Apache Log4j , Apache Solr , Apache Spark , Eclipse Jetty , Netty , Spring , Wildfly , artemis , async-http-client , aws-sdk-java , azure-sdk-for-java , bolt-connection-java , camel , cassandra-java-driver , corda , couchbase-jvm-clients , elasticsearch , flink , flink-shaded , grpc-java , infinispan , java-driver , lettuce , logging-flume , neo4j-java-driver , neo4j-ogm , netty , pulsar , rabbitmq-stream-java-client , rsocket-java , tika , wildfly , zookeeper

Affected packages:

netty-codec-dns @ 4.1.82.Final (+8602 more)