Em resumo
- CVE-2025-24970 é uma vulnerabilidade ALTO (CVSS 7.5) que afeta io.netty:netty-handler, netty (netty).
- Chance de exploração nos próximos 30 dias (EPSS): 2.2%, maior que 82.4% das vulnerabilidades.
- Correção: atualize para 4.1.118.Final, 4.1.118 ou posterior.
| Package | Affected versions | Patched versions |
|---|
| io.netty:netty-handler Maven | ≥ 4.1.91.Final, < 4.1.118.Final
| 4.1.118.Final
|
| netty | ≥ 4.1.91, < 4.1.118
| 4.1.118
|
Description
Impact
When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which can lead to a native crash.
Workarounds
As workaround its possible to either disable the usage of the native SSLEngine or changing the code from:
SslContext context = ...;
SslHandler handler = context.newHandler(....);
to:
SslContext context = ...;
SSLEngine engine = context.newEngine(....);
SslHandler handler = new SslHandler(engine, ....);
NVD description
Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which can lead to a native crash. Version 4.1.118.Final contains a patch. As workaround its possible to either disable the usage of the native SSLEngine or change the code manually.
Mais vulnerabilidades de io.netty:netty-handler
Ver tudo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free