GitHub Advisoryadvisory · Maven

GHSA-4g8c-wm8x-jfhw SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine

HIGH Published 2025-02-10 Modified 2025-04-16 Official page ↗
Aliases
CVE-2025-24970
Ecosystem
Maven
Packages
io.netty:netty-handler
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-20
Reviewed
2025-02-10

Affected packages

• Maven io.netty:netty-handler: >= 4.1.91.Final, < 4.1.118.Final → fixed in 4.1.118.Final

Description

Impact When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which can lead to a native crash. Workarounds As workaround its possible to either disable the usage of the native SSLEngine or changing the code from: ``` SslContext context = ...; SslHandler handler = context.newHandler(....); ``` to: ``` SslContext context = ...; SSLEngine engine = context.newEngine(....); SslHandler handler = new SslHandler(engine, ....); ```

Related

Alias · CVE (1)

  • CVE-2025-24970 Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References