MAVEN · AUGUST 2026 · EARLY WARNING

Netty Maven Package Vulnerability: Memory Exhaustion Risk

Q: Am I affected?

You may be affected if you are using any of the netty maven package versions listed in the affected components section of the threat data.

Q: What should I do right now?

Monitor for potential exploitation and consider applying patches as they become available. Review the affected components and version ranges to assess your exposure.

Q: Is there an official fix available?

No official fix has been published yet. Monitor the sources for updates on patches.

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.

Severity: HIGH
Affected component: netty (maven)
Affected versions: >= netty-4.1.134.Final, <= netty-4.1.134.Final or >= netty-4.2.14.Final, <= netty-4.2.14.Final or >= netty-4.1.133.Final, <= netty-4.1.133.Final or >= netty-4.2.13.Final, <= netty-4.2.13.Final or >= netty-4.2.12.Final, <= netty-4.2.12.Final or >= netty-4.1.132.Final, <= netty-4.1.132.Final or >= netty-4.2.11.Final, <= netty-4.2.11.Final or >= netty-4.1.131.Final, <= netty-4.1.131.Final or >= netty-4.2.10.Final, <= netty-4.2.10.Final or >= netty-4.2.9.Final, <= netty-4.2.9.Final or >= netty-4.1.130.Final, <= netty-4.1.130.Final or >= netty-4.2.8.Final, <= netty-4.2.8.Final or >= netty-4.1.129.Final, <= netty-4.1.129.Final or >= netty-4.1.128.Final, <= netty-4.1.128.Final or >= netty-4.2.7.Final, <= netty-4.2.7.Final or >= netty-4.2.6.Final, <= netty-4.2.6.Final or >= netty-4.1.127.Final, <= netty-4.1.127.Final or >= netty-4.2.5.Final, <= netty-4.2.5.Final or >= netty-4.1.126.Final, <= netty-4.1.126.Final or >= netty-4.1.125.Final, <= netty-4.1.125.Final or >= netty-4.2.4.Final, <= netty-4.2.4.Final or >= netty-4.1.124.Final, <= netty-4.1.124.Final or >= netty-4.1.123.Final, <= netty-4.1.123.Final or >= netty-4.2.3.Final, <= netty-4.2.3.Final or >= netty-4.2.2.Final, <= netty-4.2.2.Final or >= netty-4.1.122.Final, <= netty-4.1.122.Final or >= netty-4.2.1.Final, <= netty-4.2.1.Final or >= netty-4.1.121.Final, <= netty-4.1.121.Final or >= netty-4.1.120.Final, <= netty-4.1.120.Final or >= netty-4.2.0.Final, <= netty-4.2.0.Final or >= netty-4.1.119.Final, <= netty-4.1.119.Final or >= netty-4.1.118.Final, <= netty-4.1.118.Final or >= netty-4.1.117.Final, <= netty-4.1.117.Final or >= netty-4.1.116.Final, <= netty-4.1.116.Final or >= netty-4.1.115.Final, <= netty-4.1.115.Final or >= netty-4.1.114.Final, <= netty-4.1.114.Final or >= netty-4.1.113.Final, <= netty-4.1.113.Final or >= netty-4.1.112.Final, <= netty-4.1.112.Final or >= netty-4.1.111.Final, <= netty-4.1.111.Final or >= netty-4.1.110.Final, <= netty-4.1.110.Final or >= netty-4.1.109.Final, <= netty-4.1.109.Final or >= netty-4.1.108.Final, <= netty-4.1.108.Final or >= netty-4.1.107.Final, <= netty-4.1.107.Final or >= netty-4.1.106.Final, <= netty-4.1.106.Final or >= netty-4.1.105.Final, <= netty-4.1.105.Final or >= netty-4.1.104.Final, <= netty-4.1.104.Final or >= netty-4.1.103.Final, <= netty-4.1.103.Final or >= netty-4.1.102.Final, <= netty-4.1.102.Final or >= netty-4.1.101.Final, <= netty-4.1.101.Final or >= netty-4.1.100.Final, <= netty-4.1.100.Final or >= netty-4.1.99.Final, <= netty-4.1.99.Final or >= netty-4.1.98.Final, <= netty-4.1.98.Final or >= netty-4.1.97.Final, <= netty-4.1.97.Final or >= netty-4.1.96.Final, <= netty-4.1.96.Final or >= netty-4.1.95.Final, <= netty-4.1.95.Final or >= netty-4.1.94.Final, <= netty-4.1.94.Final or >= netty-4.1.93.Final, <= netty-4.1.93.Final or >= netty-4.1.92.Final, <= netty-4.1.92.Final or >= netty-4.1.91.Final, <= netty-4.1.91.Final or >= netty-4.1.90.Final, <= netty-4.1.90.Final or >= netty-4.1.89.Final, <= netty-4.1.89.Final or >= netty-4.1.88.Final, <= netty-4.1.88.Final or >= netty-4.1.87.Final, <= netty-4.1.87.Final or >= netty-4.1.86.Final, <= netty-4.1.86.Final or >= netty-4.1.85.Final, <= netty-4.1.85.Final or >= netty-4.1.84.Final, <= netty-4.1.84.Final or >= netty-4.1.83.Final, <= netty-4.1.83.Final or >= netty-4.1.82.Final, <= netty-4.1.82.Final or >= netty-4.1.81.Final, <= netty-4.1.81.Final or >= netty-4.1.80.Final, <= netty-4.1.80.Final or >= netty-4.1.79.Final, <= netty-4.1.79.Final or >= netty-4.1.78.Final, <= netty-4.1.78.Final or >= netty-4.1.77.Final, <= netty-4.1.77.Final or >= netty-4.1.76.Final, <= netty-4.1.76.Final or >= netty-4.1.75.Final, <= netty-4.1.75.Final or >= netty-4.1.74.Final, <= netty-4.1.74.Final or >= netty-4.1.73.Final, <= netty-4.1.73.Final or >= netty-4.1.72.Final, <= netty-4.1.72.Final or >= netty-4.1.71.Final, <= netty-4.1.71.Final or >= netty-4.1.70.Final, <= netty-4.1.70.Final or >= netty-4.1.69.Final, <= netty-4.1.69.Final or >= netty-4.1.68.Final, <= netty-4.1.68.Final or >= netty-4.1.67.Final, <= netty-4.1.67.Final or >= netty-4.1.66.Final, <= netty-4.1.66.Final or >= netty-4.1.65.Final, <= netty-4.1.65.Final or >= netty-4.1.64.Final, <= netty-4.1.64.Final or >= netty-4.1.63.Final, <= netty-4.1.63.Final or >= netty-4.1.62.Final, <= netty-4.1.62.Final or >= netty-4.1.61.Final, <= netty-4.1.61.Final or >= netty-4.1.60.Final, <= netty-4.1.60.Final or >= netty-4.1.59.Final, <= netty-4.1.59.Final or >= netty-4.1.58.Final, <= netty-4.1.58.Final or >= netty-4.1.57.Final, <= netty-4.1.57.Final or >= netty-4.1.56.Final, <= netty-4.1.56.Final or >= netty-4.1.55.Final, <= netty-4.1.55.Final or >= netty-4.1.54.Final, <= netty-4.1.54.Final or >= netty-4.1.53.Final, <= netty-4.1.53.Final or >= netty-4.1.52.Final, <= netty-4.1.52.Final or >= netty-4.1.51.Final, <= netty-4.1.51.Final or >= netty-4.1.50.Final, <= netty-4.1.50.Final or >= netty-4.1.49.Final, <= netty-4.1.49.Final or >= netty-4.1.48.Final, <= netty-4.1.48.Final or >= netty-4.1.47.Final, <= netty-4.1.47.Final or >= netty-4.1.46.Final, <= netty-4.1.46.Final or >= netty-4.1.45.Final, <= netty-4.1.45.Final or >= netty-4.1.44.Final, <= netty-4.1.44.Final or >= netty-4.1.43.Final, <= netty-4.1.43.Final or >= netty-4.1.42.Final, <= netty-4.1.42.Final or >= netty-4.1.41.Final, <= netty-4.1.41.Final or >= netty-4.1.40.Final, <= netty-4.1.40.Final or >= netty-4.1.39.Final, <= netty-4.1.39.Final or >= netty-4.1.38.Final, <= netty-4.1.38.Final or >= netty-4.1.37.Final, <= netty-4.1.37.Final or >= netty-4.1.36.Final, <= netty-4.1.36.Final or >= netty-4.1.35.Final, <= netty-4.1.35.Final or >= netty-4.1.34.Final, <= netty-4.1.34.Final or >= netty-4.1.33.Final, <= netty-4.1.33.Final or >= netty-4.1.32.Final, <= netty-4.1.32.Final or >= netty-4.1.31.Final, <= netty-4.1.31.Final or >= netty-4.1.30.Final, <= netty-4.1.30.Final or >= netty-4.1.29.Final, <= netty-4.1.29.Final or >= netty-4.1.28.Final, <= netty-4.1.28.Final or >= netty-4.1.27.Final, <= netty-4.1.27.Final or >= netty-4.1.26.Final, <= netty-4.1.26.Final or >= netty-4.1.25.Final, <= netty-4.1.25.Final or >= netty-4.1.24.Final, <= netty-4.1.24.Final or >= netty-4.1.23.Final, <= netty-4.1.23.Final or >= netty-4.1.22.Final, <= netty-4.1.22.Final or >= netty-4.1.21.Final, <= netty-4.1.21.Final or >= netty-4.1.20.Final, <= netty-4.1.20.Final or >= netty-4.1.19.Final, <= netty-4.1.19.Final or >= netty-4.1.18.Final, <= netty-4.1.18.Final or >= netty-4.1.17.Final, <= netty-4.1.17.Final or >= netty-4.1.16.Final, <= netty-4.1.16.Final or >= netty-4.1.15.Final, <= netty-4.1.15.Final or >= netty-4.1.14.Final, <= netty-4.1.14.Final or >= netty-4.1.13.Final, <= netty-4.1.13.Final or >= netty-4.1.12.Final, <= netty-4.1.12.Final or >= netty-4.1.11.Final, <= netty-4.1.11.Final or >= netty-4.1.10.Final, <= netty-4.1.10.Final or >= netty-4.1.9.Final, <= netty-4.1.9.Final or >= netty-4.1.8.Final, <= netty-4.1.8.Final or >= netty-4.1.7.Final, <= netty-4.1.7.Final or >= netty-4.1.6.Final, <= netty-4.1.6.Final or >= netty-4.1.5.Final, <= netty-4.1.5.Final or >= netty-4.1.4.Final, <= netty-4.1.4.Final or >= netty-4.1.3.Final, <= netty-4.1.3.Final or >= netty-4.1.2.Final, <= netty-4.1.2.Final or >= netty-4.1.1.Final, <= netty-4.1.1.Final or >= netty-4.1.0.Final, <= netty-4.1.0.Final or >= netty-4.1.0.CR7, <= netty-4.1.0.CR7 or >= netty-4.1.0.CR6, <= netty-4.1.0.CR6 or >= netty-4.1.0.CR5, <= netty-4.1.0.CR5 or >= netty-4.1.0.CR4, <= netty-4.1.0.CR4 or >= netty-4.1.0.CR3, <= netty-4.1.0.CR3 or >= netty-4.1.0.CR2, <= netty-4.1.0.CR2 or >= netty-4.1.0.CR1, <= netty-4.1.0.CR1 or >= netty-4.1.0.Beta8, <= netty-4.1.0.Beta8 or >= netty-4.1.0.Beta7, <= netty-4.1.0.Beta7 or >= netty-4.1.0.Beta6, <= netty-4.1.0.Beta6 or >= netty-4.1.0.Beta5, <= netty-4.1.0.Beta5 or >= netty-4.1.0.Beta4, <= netty-4.1.0.Beta4 or >= netty-4.1.0.Beta3, <= netty-4.1.0.Beta3 or >= netty-4.1.0.Beta2, <= netty-4.1.0.Beta2 or >= netty-4.1.0.Beta1, <= netty-4.1.0.Beta1 or >= netty-4.0.15.Final, <= netty-4.0.15.Final or >= netty-4.0.14.Final, <= netty-4.0.14.Final or >= netty-4.0.14.Beta1, <= netty-4.0.14.Beta1 or >= netty-4.0.13.Final, <= netty-4.0.13.Final or >= netty-4.0.12.Final, <= netty-4.0.12.Final or >= netty-4.0.11.Final, <= netty-4.0.11.Final or >= netty-4.0.10.Final, <= netty-4.0.10.Final or >= netty-4.0.8.Final, <= netty-4.0.8.Final or >= netty-4.0.7.Final, <= netty-4.0.7.Final or >= netty-4.0.6.Final, <= netty-4.0.6.Final or >= netty-4.0.5.Final, <= netty-4.0.5.Final or >= netty-4.0.4.Final, <= netty-4.0.4.Final or >= netty-4.0.3.Final, <= netty-4.0.3.Final or >= netty-4.0.2.Final, <= netty-4.0.2.Final or >= netty-4.0.1.Final, <= netty-4.0.1.Final or >= netty-4.0.0.Final, <= netty-4.0.0.Final or >= netty-4.0.0.CR9, <= netty-4.0.0.CR9 or >= netty-4.0.0.CR8, <= netty-4.0.0.CR8 or >= netty-4.0.0.CR7, <= netty-4.0.0.CR7 or >= netty-4.0.0.CR5, <= netty-4.0.0.CR5 or >= netty-4.0.0.CR4, <= netty-4.0.0.CR4 or >= netty-4.0.0.CR3, <= netty-4.0.0.CR3 or >= netty-4.0.0.CR2, <= netty-4.0.0.CR2 or >= netty-4.0.0.CR1, <= netty-4.0.0.CR1 or >= netty-4.0.0.Beta3, <= netty-4.0.0.Beta3 or >= netty-4.0.0.Beta2, <= netty-4.0.0.Beta2 or >= netty-4.0.0.Beta1, <= netty-4.0.0.Beta1 or >= netty-4.0.0.Alpha8, <= netty-4.0.0.Alpha8 or >= netty-4.0.0.Alpha7, <= netty-4.0.0.Alpha7 or >= netty-4.0.0.Alpha6, <= netty-4.0.0.Alpha6 or >= netty-4.0.0.Alpha5, <= netty-4.0.0.Alpha5 or >= netty-4.0.0.Alpha4, <= netty-4.0.0.Alpha4 or >= netty-4.0.0.Alpha3, <= netty-4.0.0.Alpha3 or >= netty-4.0.0.Alpha2, <= netty-4.0.0.Alpha2 or >= netty-4.0.0.Alpha1, <= netty-4.0.0.Alpha1
Patched version: Not yet available

CVE-2026-46340GHSA-2QJ4-MMR9-4V2F

An early warning has been issued for a critical vulnerability in the Netty maven package. The SctpMessageCompletionHandler does not limit the total size of buffered fragments, which may allow an unauthenticated attacker to cause an OutOfMemoryError by sending large SCTP fragments.

What happened

The vulnerability, tracked as CVE-2026-46340 and GHSA-2QJ4-MMR9-4V2F, was first flagged on 2026-08-17. It affects various versions of the netty maven package, as detailed in the threat data. The issue lies in the SctpMessageCompletionHandler, which fails to impose a limit on the size of buffered fragments. This oversight could be exploited by an attacker to induce an OutOfMemoryError through the transmission of oversized SCTP fragments.

Although there is no confirmed evidence of this vulnerability being exploited in the wild, the potential impact is significant. It is crucial for users of the affected netty versions to assess their exposure and take appropriate action to mitigate the risk.

What to do about it

Monitor the situation closely for any signs of exploitation.
Consider applying patches as they become available to address the vulnerability.
Review the affected components and version ranges provided in the threat data to determine if your systems are at risk.
Stay informed by consulting the primary sources for updates on the vulnerability and any released patches.

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If netty is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

You may be affected if you are using any of the netty maven package versions listed in the affected components section of the threat data.

What should I do right now?

Monitor for potential exploitation and consider applying patches as they become available. Review the affected components and version ranges to assess your exposure.

Is there an official fix available?

No official fix has been published yet. Monitor the sources for updates on patches.

Sources

Join the 0Day waitlist →

← Back to all threats