CVE-2024-47535
Medium
Description
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attempts to load a file that does not exist. If an attacker creates such a large file, the Netty application crashes. This vulnerability is fixed in 4.1.115.
SeverityMedium
CVSS5.5
Exploit probability—
ProductNetty
PublishedNov 12, 2024
First seenNov 12, 2024
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
Update
- netty netty4.1.115 or later
- io.netty:netty-common4.1.115.Final or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| netty netty | v < 4.1.115 | 4.1.115 |
| io.netty:netty-commonMaven | v < 4.1.115.Final | 4.1.115.Final |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.