SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine
Impact
When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which can lead to a native crash.
Workarounds
As workaround its possible to either disable the usage of the native SSLEngine or changing the code from:
SslContext context = ...;
SslHandler handler = context.newHandler(....);to:
SslContext context = ...;
SSLEngine engine = context.newEngine(....);
SslHandler handler = new SslHandler(engine, ....);Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | io.netty:netty-handler | >= 4.1.91.Final, < 4.1.118.Final | 4.1.118.Final |
References
- https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw
- https://nvd.nist.gov/vuln/detail/CVE-2025-24970
- https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4
- https://github.com/netty/netty
- https://security.netapp.com/advisory/ntap-20250221-0005
- https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-detection
- https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-mitigation
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- Weakness (CWE)
CWE-20- Platform
- Java / Kotlin (Maven)
- Package
io.netty:netty-handler- Disclosed
- 10.02.2025
- Updated
- 11.10.2026 13:20
Sources and licenses
OSV / GitHub Advisory Database - GHSA-4g8c-wm8x-jfhw - CC BY 4.0
Vulnerability history: io.netty:netty-handler
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 12
- First → latest
- 02.2020 09.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 7
- Medium 4
Disclosures per year
- 2020: 4
- 2021: 0
- 2022: 1
- 2023: 1
- 2024: 0
- 2025: 1
- 2026: 5
-
SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.