CVE-2025-25193
Description
Netty, an asynchronous, event-driven network application framework, has a vulnerability in versions up to and including 4.1.118.Final. An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attempts to load a file that does not exist. If an attacker creates such a large file, the Netty application crash. A similar issue was previously reported as CVE-2024-47535. This issue was fixed, but the fix was incomplete in that null-bytes were not counted against the input limit. Commit d1fbda62d3a47835d3fb35db8bd42ecc205a5386 contains an updated fix.
How to fix
- netty netty4.1.118 or later
- io.netty:netty-common4.1.118.Final or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| netty netty | v < 4.1.118 | 4.1.118 |
| io.netty:netty-commonMaven | v < 4.1.118.Final | 4.1.118.Final |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.