En bref
- CVE-2025-24970 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant io.netty:netty-handler, netty (netty).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 2.2%, plus élevée que 82.5% des vulnérabilités.
- Correctif : mettre à jour vers 4.1.118.Final, 4.1.118 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| io.netty:netty-handler Maven | ≥ 4.1.91.Final, < 4.1.118.Final
| 4.1.118.Final
|
| netty | ≥ 4.1.91, < 4.1.118
| 4.1.118
|
Description
Impact
When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which can lead to a native crash.
Workarounds
As workaround its possible to either disable the usage of the native SSLEngine or changing the code from:
SslContext context = ...;
SslHandler handler = context.newHandler(....);
to:
SslContext context = ...;
SSLEngine engine = context.newEngine(....);
SslHandler handler = new SslHandler(engine, ....);
NVD description
Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which can lead to a native crash. Version 4.1.118.Final contains a patch. As workaround its possible to either disable the usage of the native SSLEngine or change the code manually.
Autres vulnérabilités de io.netty:netty-handler
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free