Description
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attempts to load a file that does not exist. If an attacker creates such a large file, the Netty application crashes. This vulnerability is fixed in 4.1.115.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| netty | netty | < 4.1.115 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | netty | No fix yet | — |
| Ubuntu 26.04 LTS | netty | No fix yet | — |
| Ubuntu 25.10 | netty | No fix yet | — |
| Ubuntu 24.04 LTS | netty | No fix yet | — |
| Ubuntu 22.04 LTS | netty | No fix yet | — |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | netty-3.9 | No fix yet | — |
| Ubuntu 16.04 LTS | netty-3.9 | No fix yet | — |
| Ubuntu Pro 20.04 LTS | netty | No fix yet | — |
| Ubuntu Pro 18.04 LTS | netty | No fix yet | — |
| Ubuntu Pro 16.04 LTS | netty | No fix yet | — |
| Ubuntu Pro 14.04 LTS | netty | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 8 | eap8-eap-product-conf-parent +1 | 800.6.1-1.GA_redhat_00001.1.el8eap | RHSA-2025:3357 |
| Red Hat JBoss EAP 8 | eap8-netty +14 | 4.1.119-1.Final_redhat_00002.1.el8eap | RHSA-2025:3357 |
| Red Hat JBoss EAP 8 | eap8-slf4j +1 | 2.0.16-2.redhat_00003.1.el8eap | RHSA-2025:3357 |
| Red Hat JBoss EAP 8 | eap8-wildfly +4 | 8.0.6-15.GA_redhat_00009.1.el8eap | RHSA-2025:3357 |
| Red Hat JBoss EAP 7 | eap7-apache-commons-io | 2.16.1-1.redhat_00001.1.el7eap | RHSA-2025:4550, RHSA-2025:4549, RHSA-2025:4548 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.3.26-1.Final_redhat_00001.1.el7eap | RHSA-2025:4550, RHSA-2025:4549, RHSA-2025:4548 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.5.19-1.Final_redhat_00001.1.el7eap | RHSA-2025:4550, RHSA-2025:4549, RHSA-2025:4548 |
| Red Hat JBoss EAP 7 | eap7-jboss-remoting | 5.0.31-1.Final_redhat_00001.1.el7eap | RHSA-2025:4550, RHSA-2025:4549, RHSA-2025:4548 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +2 | 1.10.0-41.Final_redhat_00041.1.el7eap | RHSA-2025:4550, RHSA-2025:4549, RHSA-2025:4548 |
| Red Hat JBoss EAP 7 | eap7-weld-ejb +6 | 3.1.11-1.Final_redhat_00001.1.el7eap | RHSA-2025:4550, RHSA-2025:4549, RHSA-2025:4548 |
| Red Hat JBoss EAP 7 | eap7-wildfly +4 | 7.4.22-2.GA_redhat_00001.1.el7eap | RHSA-2025:4550, RHSA-2025:4549, RHSA-2025:4548 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron +1 | 1.15.25-1.Final_redhat_00001.1.el7eap | RHSA-2025:4550, RHSA-2025:4549, RHSA-2025:4548 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk17 | 7.4.22-2.GA_redhat_00001.1.el8eap | RHSA-2025:4550, RHSA-2025:4549 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | jctools | 4.0.5-150200.3.9.1 | SUSE-SU-2024:4407-1 |
| SLES 15 SP6 | netty | 4.1.115-150200.4.26.1 | SUSE-SU-2024:4407-1 |
| SLES 15 SP6 | netty-tcnative | 2.0.69-150200.3.22.1 | SUSE-SU-2024:4407-1 |
| SLES 15 SP5 | jctools | 4.0.5-150200.3.9.1 | SUSE-SU-2024:4407-1 |
| SLES 15 SP5 | netty | 4.1.115-150200.4.26.1 | SUSE-SU-2024:4407-1 |
| SLES 15 SP5 | netty-tcnative | 2.0.69-150200.3.22.1 | SUSE-SU-2024:4407-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Manager Server Module 4.3 | netty | 4.1.44.Final-150400.3.6.3 | SUSE-SU-2025:01994-1 |
| SUSE Manager Server Module 4.3 | susemanager-sync-data | 4.3.23-150400.3.41.3 | SUSE-SU-2025:01994-1 |
| SUSE Manager Server 4.3 | release-notes-susemanager | 4.3.15.2-150400.3.133.1 | SUSE-SU-2025:01985-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | netty | 4.1.115-1.1 | openSUSE-SU-2024:14549-1 |
| openSUSE Leap 15.6 | jctools | 4.0.5-150200.3.9.1 | SUSE-SU-2024:4407-1 |
| openSUSE Leap 15.6 | netty | 4.1.115-150200.4.26.1 | SUSE-SU-2024:4407-1 |
| openSUSE Leap 15.6 | netty-tcnative | 2.0.69-150200.3.22.1 | SUSE-SU-2024:4407-1 |
| openSUSE Leap 15.5 | jctools | 4.0.5-150200.3.9.1 | SUSE-SU-2024:4407-1 |
| openSUSE Leap 15.5 | netty | 4.1.115-150200.4.26.1 | SUSE-SU-2024:4407-1 |
| openSUSE Leap 15.5 | netty-tcnative | 2.0.69-150200.3.22.1 | SUSE-SU-2024:4407-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | apicurio-registry +2 | 3.0.6-r1 | — |
| Wolfi rolling | sonarqube +2 | 25.6.0.109173-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | io.netty:netty-common | < 4.1.115.Final | 4.1.115.Final | GHSA-xq3w-v528-46rv |
Advisories 15
- WID-SEC-2025-0135 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 3, 2026
- RHSA-2025:4550 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2025:4548 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2025:4549 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2025:3357 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.6 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- WID-SEC-2026-0254 Apache Cassandra (Netty): Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Sep 13, 2026
- WID-SEC-2025-0285 Red Hat Enterprise Linux (Quarkus und Netty): Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 16, 2026
- WID-SEC-2025-0938 IBM DB2: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Apr 27, 2026
- SUSE-SU-2025:01994-1 Security update 4.3.15.2 SUSE Manager Server 4.3 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:4407-1 Security update for aalto-xml, flatten-maven-plugin, jctools, moditect, netty, netty-tcnative SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:01985-1 Security update 4.3.15 for Multi-Linux Manager Server SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14549-1 netty-4.1.115-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-2662 IBM Informix (Dynamic Server): Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Nov 23, 2025
- WID-SEC-2025-0221 IBM WebSphere Application Server Liberty: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Sep 29, 2025
- NCSC-2025-0021 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Jan 22, 2025