Description
Netty, an asynchronous, event-driven network application framework, has a vulnerability in versions up to and including 4.1.118.Final. An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attempts to load a file that does not exist. If an attacker creates such a large file, the Netty application crash. A similar issue was previously reported as CVE-2024-47535. This issue was fixed, but the fix was incomplete in that null-bytes were not counted against the input limit. Commit d1fbda62d3a47835d3fb35db8bd42ecc205a5386 contains an updated fix.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| netty | netty | <= 4.1.118 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | netty | No fix yet | — |
| Ubuntu 25.10 | netty | No fix yet | — |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | netty | No fix yet | — |
| Ubuntu Pro 24.04 LTS | netty | No fix yet | — |
| Ubuntu Pro 22.04 LTS | netty | No fix yet | — |
| Ubuntu Pro 20.04 LTS | netty | No fix yet | — |
| Ubuntu Pro 18.04 LTS | netty | No fix yet | — |
| Ubuntu Pro 16.04 LTS | netty | No fix yet | — |
| Ubuntu Pro 14.04 LTS | netty | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 8 | eap8-eap-product-conf-parent +1 | 800.6.1-1.GA_redhat_00001.1.el8eap | RHSA-2025:3357 |
| Red Hat JBoss EAP 8 | eap8-netty +14 | 4.1.119-1.Final_redhat_00002.1.el8eap | RHSA-2025:3357 |
| Red Hat JBoss EAP 8 | eap8-slf4j +1 | 2.0.16-2.redhat_00003.1.el8eap | RHSA-2025:3357 |
| Red Hat JBoss EAP 8 | eap8-wildfly +4 | 8.0.6-15.GA_redhat_00009.1.el8eap | RHSA-2025:3357 |
| Red Hat JBoss EAP 7 | eap7-apache-commons-io | 2.16.1-1.redhat_00001.1.el7eap | RHSA-2025:4550, RHSA-2025:4549, RHSA-2025:4548 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.3.26-1.Final_redhat_00001.1.el7eap | RHSA-2025:4550, RHSA-2025:4549, RHSA-2025:4548 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.5.19-1.Final_redhat_00001.1.el7eap | RHSA-2025:4550, RHSA-2025:4549, RHSA-2025:4548 |
| Red Hat JBoss EAP 7 | eap7-jboss-remoting | 5.0.31-1.Final_redhat_00001.1.el7eap | RHSA-2025:4550, RHSA-2025:4549, RHSA-2025:4548 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +2 | 1.10.0-41.Final_redhat_00041.1.el7eap | RHSA-2025:4550, RHSA-2025:4549, RHSA-2025:4548 |
| Red Hat JBoss EAP 7 | eap7-weld-ejb +6 | 3.1.11-1.Final_redhat_00001.1.el7eap | RHSA-2025:4550, RHSA-2025:4549, RHSA-2025:4548 |
| Red Hat JBoss EAP 7 | eap7-wildfly +4 | 7.4.22-2.GA_redhat_00001.1.el7eap | RHSA-2025:4550, RHSA-2025:4549, RHSA-2025:4548 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron +1 | 1.15.25-1.Final_redhat_00001.1.el7eap | RHSA-2025:4550, RHSA-2025:4549, RHSA-2025:4548 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk17 | 7.4.22-2.GA_redhat_00001.1.el8eap | RHSA-2025:4550, RHSA-2025:4549 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | netty | 4.1.118-150200.4.29.2 | SUSE-SU-2025:0590-1 |
| SLES 15 SP6 | netty-tcnative | 2.0.70-150200.3.25.1 | SUSE-SU-2025:0590-1 |
| SLES 15 SP5 | netty-tcnative | 2.0.70-150200.3.25.1 | SUSE-SU-2025:0590-1 |
| SLES 15 SP4 | netty-tcnative | 2.0.70-150200.3.25.1 | SUSE-SU-2025:0590-1 |
| SLES 15 SP3 | netty-tcnative | 2.0.70-150200.3.25.1 | SUSE-SU-2025:0590-1 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP5 | netty-tcnative | 2.0.70-150200.3.25.1 | SUSE-SU-2025:0590-1 |
| SLES for SAP 15 SP4 | netty-tcnative | 2.0.70-150200.3.25.1 | SUSE-SU-2025:0590-1 |
| SLES for SAP 15 SP3 | netty-tcnative | 2.0.70-150200.3.25.1 | SUSE-SU-2025:0590-1 |
| SLE HPC 15 SP5 | netty-tcnative | 2.0.70-150200.3.25.1 | SUSE-SU-2025:0590-1 |
| SLE HPC 15 SP4 | netty-tcnative | 2.0.70-150200.3.25.1 | SUSE-SU-2025:0590-1 |
| SLE HPC 15 SP3 | netty-tcnative | 2.0.70-150200.3.25.1 | SUSE-SU-2025:0590-1 |
| SUSE Enterprise Storage 7.1 | netty-tcnative | 2.0.70-150200.3.25.1 | SUSE-SU-2025:0590-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | netty | 4.1.118-1.1 | openSUSE-SU-2025:14765-1 |
| openSUSE Leap 15.6 | netty | 4.1.118-150200.4.29.2 | SUSE-SU-2025:0590-1 |
| openSUSE Leap 15.6 | netty-tcnative | 2.0.70-150200.3.25.1 | SUSE-SU-2025:0590-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | celeborn-0.6 | 0.6.3-r7 | — |
| Wolfi rolling | wildfly +4 | 35.0.1-r12 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | io.netty:netty-common | < 4.1.118.Final | 4.1.118.Final | GHSA-389x-839f-4rhx |
Advisories 12
- RHSA-2025:4550 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2025:4548 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2025:4549 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2025:3357 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.6 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- WID-SEC-2025-0938 IBM DB2: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Apr 27, 2026
- WID-SEC-2025-0638 IBM WebSphere Application Server Liberty: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Apr 27, 2026
- SUSE-SU-2025:0590-1 Security update for netty, netty-tcnative SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:14765-1 netty-4.1.118-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- NCSC-2026-0022 Kwetsbaarheden verholpen in Oracle Communications producten NCSC-NL (Netherlands) · Jan 21, 2026
- WID-SEC-2026-0153 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- NCSC-2025-0335 Kwetsbaarheden verholpen in Oracle Analytics NCSC-NL (Netherlands) · Oct 23, 2025
- NCSC-2025-0123 Kwetsbaarheden verholpen in Oracle Database Producten NCSC-NL (Netherlands) · Apr 16, 2025