A vulnerability in netty-transport-sctp versions prior to 4.1.135.Final and 4.2.15.Final allows an attacker to cause unbounded memory growth by sending many incomplete SCTP message fragments. The handler accumulates fragments into a composite buffer chain without limits, which can grow indefinitely if the 'complete' flag is never set. This can lead to denial of service due to resource exhaustion. Versions 4.1.135.Final and 4.2.15.Final include patches for this issue.