Skip to content
OpenAdvisories
High · 7.5 CVE-2025-24970 EUVD-2025-3996GHSA-4g8c-wm8x-jfhw

SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine

Published Feb 10, 2025 · Updated Apr 16, 2025 · Assigned by GitHub_M

Vendor: netty Product: netty Package: akhq Package: apache-activemq-artemis Package: apache-activemq-artemis-compat Package: apache-nifi Package: apache-nifi-compat Package: apache-nifi-toolkit Package: apicurio-registry Package: apicurio-registry-nginx-config Package: apicurio-registry-ui Package: cassandra-reaper Package: celeborn-0.6 Package: cloudwatch-exporter Package: docker-selenium Package: docker-selenium-base Package: docker-selenium-compat Package: docker-selenium-distributor Package: docker-selenium-event-bus Package: docker-selenium-hub Package: docker-selenium-node-base Package: docker-selenium-node-chromium Package: docker-selenium-node-docker Package: docker-selenium-node-firefox Package: docker-selenium-router Package: docker-selenium-session-queue Package: docker-selenium-sessions Package: docker-selenium-standalone Package: docker-selenium-standalone-chrome Package: docker-selenium-standalone-chromium Package: docker-selenium-standalone-docker Package: docker-selenium-standalone-firefox Package: docker-selenium-supervisor-config Package: druid Package: druid-compat Package: flyway Package: io.netty:netty-handler Package: kafka_exporter-strimzi-compat Package: kafka-strimzi-compat Package: kserve-modelmesh Package: logstash-8-with-output-opensearch Package: management-api-for-apache-cassandra-5.0 Package: management-api-for-apache-cassandra-5.0-compat Package: netty Package: opensearch-2 Package: prometheus-jmx-exporter-strimzi-compat Package: selenium Package: selenium-server Package: selenium-server-compat Package: selenium-server-standalone Package: sonarqube-10 Package: strimzi-kafka-operator Package: strimzi-kafka-operator-cluster-operator Package: strimzi-kafka-operator-kafka-agent Package: strimzi-kafka-operator-kafka-base Package: strimzi-kafka-operator-kafka-init Package: strimzi-kafka-operator-kafka-thirdparty-libs Package: strimzi-kafka-operator-kafka-thirdparty-libs-cc Package: strimzi-kafka-operator-topic-operator Package: strimzi-kafka-operator-tracing-agent Package: strimzi-kafka-operator-user-operator Package: tez Package: thingsboard Package: thingsboard-tb-js-executor Package: thingsboard-tb-mqtt-transport Package: thingsboard-tb-node Package: thingsboard-tb-web-ui Package: trino Package: trino-config Package: trino-oci-entrypoint Package: trino-plugin-ai-functions Package: trino-plugin-bigquery Package: trino-plugin-blackhole Package: trino-plugin-cassandra Package: trino-plugin-clickhouse Package: trino-plugin-delta-lake Package: trino-plugin-druid Package: trino-plugin-duckdb Package: trino-plugin-elasticsearch Package: trino-plugin-exasol Package: trino-plugin-exchange-filesystem Package: trino-plugin-exchange-hdfs Package: trino-plugin-faker Package: trino-plugin-functions-python Package: trino-plugin-geospatial Package: trino-plugin-google-sheets Package: trino-plugin-hive Package: trino-plugin-http-event-listener Package: trino-plugin-http-server-event-listener Package: trino-plugin-hudi Package: trino-plugin-iceberg Package: trino-plugin-ignite Package: trino-plugin-jmx Package: trino-plugin-kafka Package: trino-plugin-kafka-event-listener Package: trino-plugin-lakehouse Package: trino-plugin-ldap-group-provider Package: trino-plugin-loki Package: trino-plugin-mariadb Package: trino-plugin-memory Package: trino-plugin-ml Package: trino-plugin-mongodb Package: trino-plugin-mysql Package: trino-plugin-mysql-event-listener Package: trino-plugin-opa Package: trino-plugin-openlineage Package: trino-plugin-opensearch Package: trino-plugin-oracle Package: trino-plugin-password-authenticators Package: trino-plugin-pinot Package: trino-plugin-postgresql Package: trino-plugin-prometheus Package: trino-plugin-ranger Package: trino-plugin-redis Package: trino-plugin-redshift Package: trino-plugin-resource-group-managers Package: trino-plugin-session-property-managers Package: trino-plugin-singlestore Package: trino-plugin-snowflake Package: trino-plugin-spooling-filesystem Package: trino-plugin-sqlserver Package: trino-plugin-teradata-functions Package: trino-plugin-thrift Package: trino-plugin-tpcds Package: trino-plugin-tpch Package: trino-plugin-vertica Package: wavefront-proxy Package: wavefront-proxy-compat Package: wavefront-proxy-config Package: wavefront-proxy-licenses Package: wildfly Package: wildfly-openjdk-17 Package: wildfly-openjdk-17-compat Package: wildfly-openjdk-21 Package: wildfly-openjdk-21-compat Package: zookeeper-3.9 Package: zookeeper-3.9-iamguarded-compat Ecosystem: Maven Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which can lead to a native crash. Version 4.1.118.Final contains a patch. As workaround its possible to either disable the usage of the native SSLEngine or change the code manually.

Affected products

VendorProductAffectedFixed
netty netty >= 4.1.91.Final, <= 4.1.117.Final —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 netty No fix yet —
Ubuntu 25.10 netty No fix yet —
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 26.04 LTS netty No fix yet —
Ubuntu Pro 24.04 LTS netty No fix yet —
Ubuntu Pro 22.04 LTS netty No fix yet —
Ubuntu Pro 20.04 LTS netty No fix yet —
Ubuntu Pro 18.04 LTS netty No fix yet —
Ubuntu Pro 16.04 LTS netty No fix yet —
Ubuntu Pro 14.04 LTS netty No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat JBoss EAP 8 eap8-eap-product-conf-parent +1 800.6.1-1.GA_redhat_00001.1.el8eap RHSA-2025:3357
Red Hat JBoss EAP 8 eap8-netty +14 4.1.119-1.Final_redhat_00002.1.el8eap RHSA-2025:3357
Red Hat JBoss EAP 8 eap8-slf4j +1 2.0.16-2.redhat_00003.1.el8eap RHSA-2025:3357
Red Hat JBoss EAP 8 eap8-wildfly +4 8.0.6-15.GA_redhat_00009.1.el8eap RHSA-2025:3357
Red Hat JBoss EAP 7 eap7-apache-commons-io 2.16.1-1.redhat_00001.1.el7eap RHSA-2025:4550, RHSA-2025:4549, RHSA-2025:4548
Red Hat JBoss EAP 7 eap7-hal-console 3.3.26-1.Final_redhat_00001.1.el7eap RHSA-2025:4550, RHSA-2025:4549, RHSA-2025:4548
Red Hat JBoss EAP 7 eap7-ironjacamar +8 1.5.19-1.Final_redhat_00001.1.el7eap RHSA-2025:4550, RHSA-2025:4549, RHSA-2025:4548
Red Hat JBoss EAP 7 eap7-jboss-remoting 5.0.31-1.Final_redhat_00001.1.el7eap RHSA-2025:4550, RHSA-2025:4549, RHSA-2025:4548
Red Hat JBoss EAP 7 eap7-jboss-server-migration +2 1.10.0-41.Final_redhat_00041.1.el7eap RHSA-2025:4550, RHSA-2025:4549, RHSA-2025:4548
Red Hat JBoss EAP 7 eap7-weld-ejb +6 3.1.11-1.Final_redhat_00001.1.el7eap RHSA-2025:4550, RHSA-2025:4549, RHSA-2025:4548
Red Hat JBoss EAP 7 eap7-wildfly +4 7.4.22-2.GA_redhat_00001.1.el7eap RHSA-2025:4550, RHSA-2025:4549, RHSA-2025:4548
Red Hat JBoss EAP 7 eap7-wildfly-elytron +1 1.15.25-1.Final_redhat_00001.1.el7eap RHSA-2025:4550, RHSA-2025:4549, RHSA-2025:4548
Red Hat JBoss EAP 7 eap7-wildfly-java-jdk17 7.4.22-2.GA_redhat_00001.1.el8eap RHSA-2025:4550, RHSA-2025:4549

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP6 netty 4.1.118-150200.4.29.2 SUSE-SU-2025:0590-1
SLES 15 SP6 netty-tcnative 2.0.70-150200.3.25.1 SUSE-SU-2025:0590-1
SLES 15 SP5 netty-tcnative 2.0.70-150200.3.25.1 SUSE-SU-2025:0590-1
SLES 15 SP4 netty-tcnative 2.0.70-150200.3.25.1 SUSE-SU-2025:0590-1
SLES 15 SP3 netty-tcnative 2.0.70-150200.3.25.1 SUSE-SU-2025:0590-1
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP5 netty-tcnative 2.0.70-150200.3.25.1 SUSE-SU-2025:0590-1
SLES for SAP 15 SP4 netty-tcnative 2.0.70-150200.3.25.1 SUSE-SU-2025:0590-1
SLES for SAP 15 SP3 netty-tcnative 2.0.70-150200.3.25.1 SUSE-SU-2025:0590-1
SLE HPC 15 SP5 netty-tcnative 2.0.70-150200.3.25.1 SUSE-SU-2025:0590-1
SLE HPC 15 SP4 netty-tcnative 2.0.70-150200.3.25.1 SUSE-SU-2025:0590-1
SLE HPC 15 SP3 netty-tcnative 2.0.70-150200.3.25.1 SUSE-SU-2025:0590-1
SUSE Enterprise Storage 7.1 netty-tcnative 2.0.70-150200.3.25.1 SUSE-SU-2025:0590-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed netty 4.1.118-1.1 openSUSE-SU-2025:14765-1
openSUSE Leap 15.6 netty 4.1.118-150200.4.29.2 SUSE-SU-2025:0590-1
openSUSE Leap 15.6 netty-tcnative 2.0.70-150200.3.25.1 SUSE-SU-2025:0590-1

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling akhq 0.25.1-r3 —
Wolfi rolling apache-activemq-artemis +1 2.39.0-r1 —
Wolfi rolling apache-nifi +2 2.2.0-r2 —
Wolfi rolling apicurio-registry +2 3.0.6-r1 —
Wolfi rolling cassandra-reaper 3.8.0-r2 —
Wolfi rolling celeborn-0.6 0.6.3-r7 —
Wolfi rolling cloudwatch-exporter 0.16.0-r3 —
Wolfi rolling docker-selenium +18 4.28.1.20250202-r1 —
Wolfi rolling druid +1 32.0.0-r5 —
Wolfi rolling flyway 11.3.1-r1 —
Wolfi rolling kafka-strimzi-compat +12 0.47.0-r1 —
Wolfi rolling kserve-modelmesh 0.12.0-r33 —
Wolfi rolling logstash-8-with-output-opensearch 8.17.2-r2 —
Wolfi rolling management-api-for-apache-cassandra-5.0 +1 0.1.97-r1 —
Wolfi rolling opensearch-2 2.19.1-r0 —
Wolfi rolling selenium +3 4.28.0-r1 —
Wolfi rolling sonarqube-10 No fix yet —
Wolfi rolling tez 0.10.5-r16 —
Wolfi rolling thingsboard +4 3.9.1-r1 —
Wolfi rolling trino +58 470-r3 —
Wolfi rolling wavefront-proxy +3 13.7-r5 —
Wolfi rolling wildfly +4 35.0.1-r12 —
Wolfi rolling zookeeper-3.9 +1 3.9.3-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven io.netty:netty-handler >= 4.1.91.Final, < 4.1.118.Final 4.1.118.Final GHSA-4g8c-wm8x-jfhw

Advisories 27

References