CVE-2025-24970
High
Description
Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which can lead to a native crash. Version 4.1.118.Final contains a patch. As workaround its possible to either disable the usage of the native SSLEngine or change the code manually.
SeverityHigh
CVSS7.5
Exploit probability—
ProductNetty
PublishedFeb 10, 2025
First seenFeb 10, 2025
Weakness typeCWE-20Improper input validation
How to fix
Update
- netty netty4.1.118 or later
- io.netty:netty-handler4.1.118.Final or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| netty netty | 4.1.91 ≤ v < 4.1.118 | 4.1.118 |
| netapp active_iq_unified_manager | No range specified | — |
| netapp oncommand_insight | No range specified | — |
| io.netty:netty-handlerMaven | 4.1.91.Final ≤ v < 4.1.118.Final | 4.1.118.Final |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.