CVE-2025-24970
SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine
In short
Netty's SslHandler fails to properly validate specially crafted SSL/TLS packets, which can crash the application when using native SSL engines. This affects applications relying on Netty for secure network communication.
Technical detail
A validation bypass in Netty's SslHandler (versions 4.1.91.Final through 4.1.117.Final) allows an attacker to send a malformed SSL/TLS packet that bypasses input validation checks, triggering a native crash in the underlying OpenSSL library when native SSLEngine is enabled. The attack requires network access to send the crafted packet and results in denial of service.
Summary generated and translated by AI from the official description.
Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which can lead to a native crash. Version 4.1.118.Final contains a patch. As workaround its possible to either disable the usage of the native SSLEngine or change the code manually.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
netty · nettyWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →References
https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhwhttps://security.netapp.com/advisory/ntap-20250221-0005/https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-detectionhttps://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-mitigation