CVE-2025-24970 Netty — Exploit & Vulnerability Details HIGH

Parameter	Value
CVSS	7.5 (HIGH)
Affected Versions	4.1.91 — 4.1.118
Fixed In	4.1.118
Type	CWE-20 (Improper Input Validation)
Vendor	Netty
Public PoC	No

Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which can lead to a native crash. Version 4.1.118.Final contains a patch.

As workaround its possible to either disable the usage of the native SSLEngine or change the code manually.

Attack Parameters

Attack Vector

Network

Can be exploited remotely

Attack Complexity

Low

Easy to exploit

Privileges Required

None

No privileges needed

User Interaction

None

No user interaction needed

Impact Assessment

Confidentiality

None

No data leak

Integrity

None

No data modification

Availability

High

Complete denial of service

CVSS Vector v3.1

Weakness Type (CWE)

CWE-20 Improper Input Validation

Vulnerable Products 5

Configuration	From (including)	Up to (excluding)
Netty Netty cpe:2.3:a:netty:netty::::::::	`4.1.91`	`4.1.118`
Netapp Active_Iq_Unified_Manager cpe:2.3:a:netapp:active_iq_unified_manager:-:::::linux::	—	—
Netapp Active_Iq_Unified_Manager cpe:2.3:a:netapp:active_iq_unified_manager:-:::::vmware_vsphere::	—	—
Netapp Active_Iq_Unified_Manager cpe:2.3:a:netapp:active_iq_unified_manager:-:::::windows::	—	—
Netapp Oncommand_Insight cpe:2.3:a:netapp:oncommand_insight:-:::::::*	—	—