Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-4g8c-wm8x-jfhw
Advisory ID github_osv/GHSA-4g8c-wm8x-jfhw
Aliases CVE-2025-24970
Summary SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine ### Impact When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which can lead to a native crash. ### Workarounds As workaround its possible to either disable the usage of the native SSLEngine or changing the code from: ``` SslContext context = ...; SslHandler handler = context.newHandler(....); ``` to: ``` SslContext context = ...; SSLEngine engine = context.newEngine(....); SslHandler handler = new SslHandler(engine, ....); ```
Status Published
Exploitability 0.5
Weighted Severity 6.8
Risk 3.4
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-20 Improper Input Validation
System Score Found at
cvssv3.1 7.5 https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-4g8c-wm8x-jfhw/GHSA-4g8c-wm8x-jfhw.json
generic_textual HIGH
Reference id Reference type URL
https://github.com/netty/netty
https://security.netapp.com/advisory/ntap-20250221-0005
87f40725155b2f89adfde68c7732f97c153676c4 Other https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4
CVE-2025-24970 https://nvd.nist.gov/vuln/detail/CVE-2025-24970
CVE-2025-24970-NETTY-VULNERABILITY-DETECTION https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-detection
CVE-2025-24970-NETTY-VULNERABILITY-MITIGATION https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-mitigation
GHSA-4g8c-wm8x-jfhw Other https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-4g8c-wm8x-jfhw/GHSA-4g8c-wm8x-jfhw.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

There are no SSVC decisions available.