CVE-2026-46340: Netty SCTP Transport DOS Vulnerability

CVE-2026-46340 Overview

CVE-2026-46340 is an unbounded resource consumption vulnerability in the Netty network application framework. The flaw resides in the netty-transport-sctp module's handling of Stream Control Transmission Protocol (SCTP) message fragments. For each incomplete SctpMessage fragment, the handler wraps the previous accumulator and the new slice into a new CompositeByteBuf without bounds. A remote peer that never sets the complete flag can grow this structure indefinitely using tiny 1-byte DATA chunks. The vulnerability affects versions prior to 4.1.135.Final and 4.2.15.Final, and it is classified under [CWE-770] (Allocation of Resources Without Limits or Throttling).

Critical Impact
A remote unauthenticated attacker can exhaust server memory and CPU by sending incomplete SCTP fragments across multiple stream identifiers, resulting in denial of service.

Affected Products

Netty netty-transport-sctp versions prior to 4.1.135.Final
Netty netty-transport-sctp versions prior to 4.2.15.Final
Applications using Netty's SCTP transport for protocol server or client implementations

Discovery Timeline

2026-06-12 - CVE-2026-46340 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-46340

Vulnerability Analysis

The vulnerability stems from how netty-transport-sctp accumulates incomplete SCTP message fragments. When a fragment arrives without the complete flag set, the handler executes fragments.put(streamId, Unpooled.wrappedBuffer(frag, byteBuf)). This call wraps the existing accumulator together with the new slice into a fresh CompositeByteBuf.

After N fragments, the accumulator becomes an N-deep chain of nested composites. Each level holds references and component arrays. Subsequent calls to readableBytes() or getBytes() on the final buffer recurse N levels deep, compounding CPU cost alongside the memory pressure.

The handler imposes no upper bound on the number of fragments per stream, the total bytes accumulated, or the number of stream identifiers a peer can open. Each new streamId allocates its own map entry, multiplying the attack surface.

Root Cause

The root cause is missing resource limits in the SCTP fragment reassembly logic. The implementation trusts the peer to eventually signal completion. A malicious or malfunctioning peer that withholds the complete flag and rotates stream identifiers triggers unbounded memory growth and recursive buffer operations.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker establishes an SCTP association with a vulnerable Netty server and transmits a stream of single-byte DATA chunks. By varying the streamId and never setting complete, the attacker forces the server to retain and nest fragments until memory is exhausted. The vulnerability produces availability impact only, with no confidentiality or integrity exposure.

No public proof-of-concept or exploit code is currently available. See the GitHub Security Advisory GHSA-5xrh-qmmq-w6ch for technical details published by the maintainers.

Detection Methods for CVE-2026-46340

Indicators of Compromise

Sustained SCTP traffic from a single peer composed of very small DATA chunks (often 1 byte) that never set the complete flag
Rapid growth in the number of distinct streamId values observed within a single SCTP association
Java Virtual Machine (JVM) heap growth, increased garbage collection activity, or OutOfMemoryError events correlated with SCTP listener activity

Detection Strategies

Inspect SCTP traffic for peers that open many stream identifiers without completing message reassembly
Monitor Netty application logs for buffer allocation warnings or composite buffer depth anomalies
Track heap utilization on hosts running Netty SCTP services and alert on sustained upward trends without corresponding throughput

Monitoring Recommendations

Capture JVM heap dumps when memory thresholds are exceeded to identify deep CompositeByteBuf chains tied to SctpMessageCompletionHandler
Enable network telemetry for SCTP traffic flows, recording per-association fragment counts and stream identifier diversity
Correlate availability incidents on SCTP services with peer source addresses to identify abusive clients

How to Mitigate CVE-2026-46340

Immediate Actions Required

Upgrade netty-transport-sctp to version 4.1.135.Final or 4.2.15.Final without delay
Inventory all applications and dependencies that pull in the Netty SCTP transport module, including transitive dependencies
Restrict network exposure of SCTP listeners to trusted peers using firewall or access control list rules

Patch Information

Netty maintainers released fixes in versions 4.1.135.Final and 4.2.15.Final. Refer to the Netty 4.1.135 release notes and the Netty 4.2.15 release notes for upgrade guidance. The full advisory is available at GHSA-5xrh-qmmq-w6ch.

Workarounds

If immediate patching is not possible, terminate or proxy SCTP connections through a component that enforces fragment and stream identifier limits
Disable the SCTP transport entirely if it is not required by the application
Apply network-level rate limiting and connection quotas on SCTP traffic to reduce the impact of unbounded fragment accumulation

bash

# Update Netty SCTP transport in Maven dependency declarations
mvn versions:use-dep-version -Dincludes=io.netty:netty-transport-sctp -DdepVersion=4.1.135.Final -DforceVersion=true

# Or for the 4.2.x branch
mvn versions:use-dep-version -Dincludes=io.netty:netty-transport-sctp -DdepVersion=4.2.15.Final -DforceVersion=true