CVE-2026-46340: Netty: SCTP reassembly nests buffers without bound

Synopsis

An unbounded memory growth vulnerability exists in the SCTP message reassembly handler of Netty's netty-transport-sctp component. The flaw is reachable over the network with no authentication required, and an attacker can exploit it by sending a continuous stream of single-byte SCTP DATA chunks with the 'complete' flag never set, causing the JVM process to exhaust available heap memory. Successful exploitation results in a denial of service, crashing or rendering unresponsive any service that uses Netty's SCTP transport. No fix versions have been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to open an SCTP connection to the target service over the network; no local access or physical presence is needed.

• AuthenticationNot required

  No credentials or session token are needed; any peer that can establish an SCTP connection can send the malformed fragment stream.

• Victim interactionNot required

  Exploitation is fully attacker-driven; no user action, click, or session from a legitimate user is required.

• Attack complexityDetail

  The exploit is reliable and condition-free: the attacker only needs to send a continuous stream of 1-byte chunks without setting the 'complete' flag, with no race conditions or memory-layout dependencies to manage.

Blast Radius

• Heap memory is consumed without bound by the growing composite-buffer chain, eventually exhausting the JVM's available memory.
• The affected Netty-based service crashes or stops accepting and processing requests, causing a full denial of service.
• Each distinct SCTP stream identifier opened by the attacker gets its own map entry, multiplying memory pressure and accelerating heap exhaustion.
• Recovery requires a process restart; any in-flight state held in the Netty pipeline, such as partially assembled messages for legitimate peers, is lost.