Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2025-24970
CVE-2025-24970:
Java vulnerability analysis and mitigation
Overview
Netty, an asynchronous, event-driven network application framework, contains a vulnerability (CVE-2025-24970) affecting versions from 4.1.91.Final up to 4.1.117.Final. The vulnerability was discovered and disclosed on February 10, 2025, impacting the SslHandler component when processing specially crafted packets (GitHub Advisory, NVD).
Technical details
The vulnerability stems from improper input validation (CWE-20) in Netty's SslHandler component when handling SSL/TLS packets. When a specially crafted packet is received via SslHandler, the validation process fails to handle all cases correctly, which can trigger a native crash. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating it can be exploited remotely with low attack complexity and requires no privileges or user interaction (Red Hat, GitHub Advisory).
Impact
The vulnerability directly impacts the stability and reliability of applications using native SSLEngine. When exploited, it can lead to a complete process termination, potentially causing a Denial of Service (DoS) that affects high-availability systems and mission-critical services (Red Hat).
Mitigation and workarounds
A patch is available in version 4.1.118.Final. For users unable to upgrade immediately, two workarounds are available: either disable the usage of the native SSLEngine, or modify the code to use explicit SSLEngine instantiation by changing from 'SslContext context = ...; SslHandler handler = context.newHandler(...);' to 'SslContext context = ...; SSLEngine engine = context.newEngine(...); SslHandler handler = new SslHandler(engine, ...);' (GitHub Advisory).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management