CVE-2025-24970highCWE-20

CVE-2025-24970: high-severity vulnerability in netty

SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine

Published · Updated

Follow this CVE+ Monitor netty+ Monitor io.netty:netty-handler

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 2.2%
In short

Netty's SslHandler fails to properly validate specially crafted SSL/TLS packets, which can crash the application when using native SSL engines. This affects applications relying on Netty for secure network communication.

Technical detail

A validation bypass in Netty's SslHandler (versions 4.1.91.Final through 4.1.117.Final) allows an attacker to send a malformed SSL/TLS packet that bypasses input validation checks, triggering a native crash in the underlying OpenSSL library when native SSLEngine is enabled. The attack requires network access to send the crafted packet and results in denial of service.

Summary generated and translated by AI from the official description.
Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which can lead to a native crash. Version 4.1.118.Final contains a patch. As workaround its possible to either disable the usage of the native SSLEngine or change the code manually.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
netty · netty
Related CVEs — netty

In the same product, most dangerous first.

CVE-2021-21409MEDIUMPossible request smuggling in HTTP/2 due missing validation of content-lengthEPSS 4.9%CVE-2021-43797MEDIUMHTTP fails to validate against control chars in header names which may lead to HTTP request smugglingEPSS 2.9%CVE-2023-34462MEDIUMnetty-handler SniHandler 16MB allocationEPSS 2.5%CVE-2021-21290MEDIUMLocal Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary filesEPSS 1.8%CVE-2022-41881MEDIUMCVE-2022-41881EPSS 1.6%CVE-2025-59419MEDIUMNetty netty-codec-smtp SMTP Command Injection Vulnerability Allowing Email ForgeryEPSS 1.6%