CVE-2025-24970CWE-20

SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine

High · published February 10, 2025

CVSS v3.1
7.5
EPSS
2%
Percentile
82.3
In the wild
Unconfirmed
What it is

Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which can lead to a native crash. Version 4.1.118.Final contains a patch. As workaround its possible to either disable the usage of the native SSLEngine or change the code manually.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.02192 · 82.3th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2025-02-10T21:57Z
EPSS history
Timeline
  • 10 FEB 21:57Z
    SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine
    cvelistv5