CVE-2025-24970: SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine
Impact When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which can lead to a native crash.
Workarounds As workaround its possible to either disable the usage of the native SSLEngine or changing the code from:
SslContext context = ...; SslHandler handler = context.newHandler(....);
to:
SslContext context = ...; SSLEngine engine = context.newEngine(....); SslHandler handler = new SslHandler(engine, ....);
Other sources
Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which can lead to a native crash. Version 4.1.118.Final contains a patch. As workaround its possible to either disable the usage of the native SSLEngine or change the code manually.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-24970?
CVE-2025-24970 is considered a moderate severity vulnerability as it can lead to a native crash due to improper handling of crafted packets.
How do I fix CVE-2025-24970?
To fix CVE-2025-24970, either update to io.netty:netty-handler version 4.1.118.Final or disable the use of the native SSLEngine.
What software is affected by CVE-2025-24970?
CVE-2025-24970 affects io.netty:netty-handler versions between 4.1.91.Final and 4.1.117.Final.
What causes the vulnerability in CVE-2025-24970?
The vulnerability in CVE-2025-24970 is caused by incorrect validation of specially crafted packets in the SslHandler.
Can I continue using affected versions with CVE-2025-24970?
It is not recommended to continue using affected versions of io.netty:netty-handler as they may lead to application crashes.