SB2025021186 - Multiple vulnerabilities in Netty

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Input validation error (CVE-ID: CVE-2025-24970)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in SslHandler when using native SSLEngine. A remote attacker can send a specially crafted packet to the application and perform a denial of service (DoS) attack.

2) Resource exhaustion (CVE-ID: CVE-2025-25193)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to application attempts to load a file that does not exist. A local user can create a large file on the system and crash the application.

Note, the vulnerability affects Windows installations only.

Remediation

Install update from vendor's website.

References

• https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4
• https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw
• https://github.com/netty/netty/commit/d1fbda62d3a47835d3fb35db8bd42ecc205a5386
• https://github.com/netty/netty/security/advisories/GHSA-389x-839f-4rhx