Input validation error in Netty - CVE-2025-24970

Vulnerability identifier: #VU103770

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-24970

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in SslHandler when using native SSLEngine. A remote attacker can send a specially crafted packet to the application and perform a denial of service (DoS) attack.

Netty
IBM Operator for Apache Flink
Netcool Operations Insight
IBM Fusion HCI
IBM Security Guardium Key Lifecycle Manager (GKLM)
IT Service Intelligence (ITSI)
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Knowledge Catalog in Cloud Pak for Data
Jira Service Management Server
Jira Service Management Data Center
Crowd Data Center
IBM Sterling Partner Engagement Manager
Confluence Data Center
Bitbucket Data Center
Bamboo Server
Jira Software Data Center
IBM Security Verify Governance
Oracle Banking APIs
IBM Cloud Pak for Business Automation
Oracle Communications Cloud Native Core Network Exposure Function
Oracle Communications Cloud Native Core Binding Support Function
Oracle Communications Cloud Native Core Certificate Management
Oracle Communications Cloud Native Core Network Repository Function
IBM Observability with Instana
Red Hat Integration Camel-K
IBM Cloud Pak for Security
PowerVC
Red Hat build of Quarkus
Dell Secure Connect Gateway
IBM Maximo Application Suite - Manage Component
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Enterprise Storage
SUSE Package Hub 15
Development Tools Module
openSUSE Leap
Netezza Appliance
IBM Application Suite - IBM Asset Data Dictionary Component
Rapid Infrastructure Automation
Operations Analytics - Log Analysis
Watson Query on Cloud Pak for Data
Oracle Utilities Network Management System
Data Virtualization (DV) on Cloud Pak for Data (CPD)
Security QRadar EDR
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
Knowledge Catalog Premium Cartridge
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component
Db2 Big SQL
IBM Business Automation Manager Open Editions
Oracle Business Intelligence Enterprise Edition
Maximo Application Suite - Monitor Component
IBM OpenPages with Watson
Oracle Communications Network Charging and Control
Oracle Banking Digital Experience
Oracle Retail Xstore Point of Service
Business Automation Insights
User Entity Behavior Analytics
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
watsonx Assistant Cartridge
StreamSets Data Collector
Maximo Application Suite - IoT Component
Telco Service Activator
webMethods Managed File Transfer
IBM Event Endpoint Management
Guardium Data Protection
Voice Gateway
Communications Unified Assurance
Communications Service Catalog and Design
Oracle Communications Instant Messaging Server
Oracle Communications Billing and Revenue Management
Oracle Communications Offline Mediation Controller
watsonx.data
IBM Cloud Pak System
Crowd Server
JBoss Enterprise Application Platform
Bitbucket Server
Oracle Coherence
AMQ Streams
Oracle Communications Order and Service Management
RSA Authentication Manager
Confluence Server
PeopleSoft Enterprise PeopleTools
Planning Analytics Local
Operational Decision Manager
Jira Software Server
JBoss Data Grid
Oracle Communications Pricing Design Center
Oracle Banking Origination
Stream Analytics
Oracle TimesTen In-Memory Database
Oracle NoSQL Database
Oracle GoldenGate Big Data and Application Adapters
Oracle Communications Cloud Native Core Policy
Oracle Communications Cloud Native Core Console
Oracle Communications Cloud Native Core Unified Data Repository
Oracle Communications Cloud Native Core Security Edge Protection Proxy
Oracle Communications Cloud Native Core Network Slice Selection Function
eap7-ironjacamar (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
eap7-wildfly-elytron (Red Hat package)
eap8-slf4j (Red Hat package)
netty-tcnative
netty-tcnative-javadoc
eap7-apache-commons-io (Red Hat package)
eap7-weld-core (Red Hat package)
eap7-hal-console (Red Hat package)
netty
netty-javadoc
eap8-netty-transport-native-epoll (Red Hat package)
eap8-netty (Red Hat package)
eap7-jboss-remoting (Red Hat package)
eap7-wildfly (Red Hat package)
eap8-wildfly (Red Hat package)
eap8-eap-product-conf-parent (Red Hat package)
Red Hat Camel for Spring Boot

Install updates from vendor's website.

Netty - update to 4.1.118
IBM Operator for Apache Flink - update to 1.4.5
Netezza Appliance - update to 1.0.0.1
Voice Gateway - update to 1.0.8.19
IBM Application Suite - IBM Asset Data Dictionary Component - update to 1.1.17
Rapid Infrastructure Automation - update to 1.1.5.3
Operations Analytics - Log Analysis - update to 1.3.8.4
Netcool Operations Insight - update to 1.6.15
watsonx.data - update to 2.1.3
IBM Fusion HCI - update to 2.10.0
IBM Cloud Pak System - update to 2.3.6.1
Data Virtualization (DV) on Cloud Pak for Data (CPD) - update to 3.2.1
Security QRadar EDR - update to 3.12.16
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.2
IT Service Intelligence (ITSI) - update to 4.21.2
Knowledge Catalog Premium Cartridge - update to 5.2
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.1.1
IBM Watson Knowledge Catalog in Cloud Pak for Data - update to 5.2
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component - update to 5.1.3
Jira Service Management Server - addressed in versions 5.12.20, 10.3.5, 10.5.1, 10.6.0
Jira Service Management Data Center - addressed in versions 5.12.20, 10.3.5, 10.5.1, 10.6.0
Crowd Data Center - update to 6.2.3
Crowd Server - update to 6.2.3
IBM Sterling Partner Engagement Manager - addressed in versions 6.2.3.5, 6.2.4.2
JBoss Enterprise Application Platform - addressed in versions 7.4.21, 7.4.22, 8.0.6
Db2 Big SQL - update to 8.1
Confluence Data Center - addressed in versions 8.5.20, 9.2.2, 9.3.2
Confluence Server - addressed in versions 8.5.20, 9.2.2, 9.3.2
IBM Business Automation Manager Open Editions - update to 8.0.8
RSA Authentication Manager - update to 8.8 Patch 1
Bitbucket Server - addressed in versions 8.9.27, 8.19.18, 9.4.5, 9.5.2, 9.6.2
Bitbucket Data Center - addressed in versions 8.9.27, 8.19.18, 9.4.5, 9.5.2, 9.6.2
Maximo Application Suite - Monitor Component - addressed in versions 8.10.19, 8.11.17, 9.0.9, 9.1.0
IBM OpenPages with Watson - update to 9.1.2
Bamboo Server - addressed in versions 9.6.11, 10.2.2
Jira Software Server - addressed in versions 9.12.20, 10.3.5, 10.5.1, 10.6.0
Jira Software Data Center - addressed in versions 9.12.20, 10.3.5, 10.5.1, 10.6.0
Business Automation Insights - addressed in versions 24.0.0.0.4, 24.0.1.0.4
IBM Cloud Pak for Business Automation - addressed in versions 24.0.0-IF005, 24.0.1-IF004, 25.0.0
IBM Observability with Instana - update to 291
eap7-ironjacamar (Red Hat package) - addressed in versions 1.5.19-1.Final_redhat_00001.1.el7eap, 1.5.19-1.Final_redhat_00001.1.el8eap, 1.5.19-1.Final_redhat_00001.1.el9eap
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-41.Final_redhat_00041.1.el7eap, 1.10.0-41.Final_redhat_00041.1.el8eap, 1.10.0-41.Final_redhat_00041.1.el9eap
Red Hat Integration Camel-K - update to 1.10.10
IBM Cloud Pak for Security - update to 1.11.2.0
eap7-wildfly-elytron (Red Hat package) - addressed in versions 1.15.25-1.Final_redhat_00001.1.el7eap, 1.15.25-1.Final_redhat_00001.1.el8eap, 1.15.25-1.Final_redhat_00001.1.el9eap
AMQ Streams - update to 2
Planning Analytics Local - addressed in versions 2.0.0.103, 2.1.10
eap8-slf4j (Red Hat package) - addressed in versions 2.0.16-2.redhat_00003.1.el8eap, 2.0.16-2.redhat_00003.1.el9eap
netty-tcnative - update to 2.0.70-150200.3.25.1
netty-tcnative-javadoc - update to 2.0.70-150200.3.25.1
PowerVC - addressed in versions 2.1.1.2, 2.3.0
eap7-apache-commons-io (Red Hat package) - addressed in versions 2.16.1-1.redhat_00001.1.el7eap, 2.16.1-1.redhat_00001.1.el8eap, 2.16.1-1.redhat_00001.1.el9eap
eap7-weld-core (Red Hat package) - addressed in versions 3.1.11-1.Final_redhat_00001.1.el7eap, 3.1.11-1.Final_redhat_00001.1.el8eap, 3.1.11-1.Final_redhat_00001.1.el9eap
eap7-hal-console (Red Hat package) - addressed in versions 3.3.26-1.Final_redhat_00001.1.el7eap, 3.3.26-1.Final_redhat_00001.1.el8eap, 3.3.26-1.Final_redhat_00001.1.el9eap
Red Hat build of Quarkus - update to 3.15.3.SP1
netty - update to 4.1.118-150200.4.29.2
netty-javadoc - update to 4.1.118-150200.4.29.2
eap8-netty-transport-native-epoll (Red Hat package) - addressed in versions 4.1.119-1.Final_redhat_00002.1.el8eap, 4.1.119-1.Final_redhat_00002.1.el9eap
eap8-netty (Red Hat package) - addressed in versions 4.1.119-1.Final_redhat_00002.1.el8eap, 4.1.119-1.Final_redhat_00002.1.el9eap
Red Hat Camel for Spring Boot - update to 4.8.5
User Entity Behavior Analytics - update to 5.0.2
eap7-jboss-remoting (Red Hat package) - addressed in versions 5.0.31-1.Final_redhat_00001.1.el7eap, 5.0.31-1.Final_redhat_00001.1.el8eap, 5.0.31-1.Final_redhat_00001.1.el9eap
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.3.0
watsonx Assistant Cartridge - update to 5.3.0
Dell Secure Connect Gateway - update to 5.28.00.14
StreamSets Data Collector - update to 7.0.0
eap7-wildfly (Red Hat package) - addressed in versions 7.4.22-2.GA_redhat_00001.1.el7eap, 7.4.22-2.GA_redhat_00001.1.el8eap, 7.4.22-2.GA_redhat_00001.1.el9eap
eap8-wildfly (Red Hat package) - addressed in versions 8.0.6-15.GA_redhat_00009.1.el8eap, 8.0.6-15.GA_redhat_00009.1.el9eap
JBoss Data Grid - update to 8.5.3
IBM Maximo Application Suite - Manage Component - addressed in versions 8.6.24, 8.7.18, 9.0.11
Maximo Application Suite - IoT Component - addressed in versions 8.7.22, 8.8.18, 9.0.8
Operational Decision Manager - addressed in versions 8.11.0.1 Interim fix 42, 8.11.1.0 Interim fix 39, 8.12.0.1 Interim fix 24, 9.0.0.1 Interim fix 7
Telco Service Activator - update to 10.2.1
webMethods Managed File Transfer - update to 11.1 Server Fix2
IBM Event Endpoint Management - update to 11.4.2
Guardium Data Protection - update to 12.0p40
eap8-eap-product-conf-parent (Red Hat package) - addressed in versions 800.6.1-1.GA_redhat_00001.1.el8eap, 800.6.1-1.GA_redhat_00001.1.el9eap

• https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4
• https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw

• Multiple vulnerabilities in Netty
• SUSE update for netty, netty-tcnative
• Multiple vulnerabilities in IBM Event Endpoint Management
• Multiple vulnerabilities in IBM Security QRadar EDR
• Multiple vulnerabilities in IBM Observability with Instana
• Crowd Data Center and Server update for netty-handler
• Bamboo Data Center and Server update for Netty
• Multiple vulnerabilities in JBoss Data Grid 8.5
• Input validation error in Red Hat Integration Camel-K 1.10
• Multiple vulnerabilities in Red Hat Camel for Spring Boot 4.8
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4
• Multiple vulnerabilities in Red Hat build of Quarkus
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 8.0
• IBM Maximo Application Suite - Manage Component update for Netty
• Multiple vulnerabilities in IBM Voice Gateway
• Confluence Data Center and Server update for netty-handler
• Multiple vulnerabilities in Oracle TimesTen In-Memory Database
• Multiple vulnerabilities in Oracle Communications Instant Messaging Server
• Multiple vulnerabilities in Oracle Communications Order and Service Management
• Input validation error in Oracle Communications Network Charging and Control
• Multiple vulnerabilities in Oracle Communications Billing and Revenue Management
• Multiple vulnerabilities in Communications Service Catalog and Design
• Multiple vulnerabilities in Oracle Communications Pricing Design Center
• Multiple vulnerabilities in Communications Unified Assurance
• Multiple vulnerabilities in Oracle Banking Digital Experience
• Multiple vulnerabilities in Oracle Banking APIs
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Policy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Binding Support Function
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Security Edge Protection Proxy
• Input validation error in Oracle Communications Cloud Native Core Certificate Management
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Repository Function
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Console
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Unified Data Repository
• Input validation error in Oracle Coherence
• Multiple vulnerabilities in IBM Cloud Pak for Security
• Multiple vulnerabilities in IBM Operational Decision Manager
• IBM Maximo Application Suite - IoT Component update for Netty
• IBM Asset Data Dictionary Component update for Netty
• IBM watsonx.data update for Netty
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 7
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4
• Multiple vulnerabilities in IBM Planning Analytics Local - IBM Planning Analytics Workspace
• IBM Maximo Application Suite - Monitor Component update for Netty
• Multiple vulnerabilities in Dell Secure Connect Gateway
• Jira Software Data Center and Server update for io.netty:netty-handler
• Jira Service Management Data Center and Server update for io.netty:netty-handler
• IBM Watson Discovery update for Netty
• Multiple vulnerabilities in IBM Guardium Data Protection
• Multiple vulnerabilities in IBM Rapid Infrastructure Automation
• Multiple vulnerabilities in IBM Fusion
• RSA Authentication Manager update for third-party components
• Input validation error in HPE Telco Service Activator
• Bitbucket Data Center and Server update for Netty
• Multiple vulnerabilities in AMQ Streams
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data update for Netty
• Input validation error in Oracle NoSQL Database
• Multiple vulnerabilities in Stream Analytics
• Multiple vulnerabilities in Oracle GoldenGate Big Data and Application Adapters
• Multiple vulnerabilities in Oracle Communications Offline Mediation Controller
• Multiple vulnerabilities in Oracle Banking Origination
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Slice Selection Function
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Exposure Function
• Multiple vulnerabilities in PeopleSoft Enterprise PeopleTools
• IBM watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component update for Netty
• Multiple vulnerabilities in IBM PowerVC
• Multiple vulnerabilities in IBM Business Automation Insights
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Multiple vulnerabilities in IBM Security Guardium Key Lifecycle Manager
• Multiple vulnerabilities in IBM Data Virtualization on IBM Software Hub
• Multiple vulnerabilities in IBM Security Verify Governance
• Multiple vulnerabilities in IBM OpenPages
• Multiple vulnerabilities in IBM User Entity Behavior Analytics
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in IBM Sterling Partner Engagement Manager Essentials Edition
• IBM Netezza Appliance update for Netty
• Multiple vulnerabilities in IBM StreamSets Data Collector
• Multiple vulnerabilities in IBM webMethods Managed File Transfer
• IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge update for Netty
• Multiple vulnerabilities in Oracle Utilities Network Management System
• Multiple vulnerabilities in Oracle Retail Xstore Point of Service
• Multiple vulnerabilities in IBM Big SQL on IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Cloud Pak System
• Multiple vulnerabilities in IBM Operator for Apache Flink
• Multiple vulnerabilities in IBM Knowledge Catalog Premium Cartridge
• Multiple vulnerabilities in IBM Operations Analytics - Log Analysis
• Splunk IT Service Intelligence update for third-party components
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• Multiple vulnerabilities in IBM Watson Knowledge Catalog on-prem