Vulnerabilities affecting this package (0)
| Vulnerability |
Summary |
Fixed by |
|
This package is not known to be affected by vulnerabilities.
|
Vulnerabilities fixed by this package (1)
| Vulnerability |
Summary |
Aliases |
|
VCID-epex-9q5x-ykf3
|
SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine
### Impact
When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which can lead to a native crash.
### Workarounds
As workaround its possible to either disable the usage of the native SSLEngine or changing the code from:
```
SslContext context = ...;
SslHandler handler = context.newHandler(....);
```
to:
```
SslContext context = ...;
SSLEngine engine = context.newEngine(....);
SslHandler handler = new SslHandler(engine, ....);
```
|
CVE-2025-24970
GHSA-4g8c-wm8x-jfhw
|