CVE-2025-24970: SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine

Description

Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which can lead to a native crash. Version 4.1.118.Final contains a patch. As workaround its possible to either disable the usage of the native SSLEngine or change the code manually.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)2.2% · higher than 82% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

NE

netty · netty

>= 4.1.91.Final, <= 4.1.117.Final · source: vendor, NVD

AI

Active IQ Unified Manager · Netapp

All versions, or not specified · source: NVD

OI

Oncommand Insight · Netapp

All versions, or not specified · source: NVD