CVE-2025-24970

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-24970
Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which can lead to a native crash. Version 4.1.118.Final contains a patch. As workaround its possible to either disable the usage of the native SSLEngine or change the code manually.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4 Patch
https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw Vendor Advisory
https://security.netapp.com/advisory/ntap-20250221-0005/ Third Party Advisory
https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-detection Exploit Third Party Advisory
https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-mitigation Exploit Mitigation Third Party Advisory
https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*
History

05 Sep 2025, 17:20

Type Values Removed Values Added
CPE cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*
cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*
First Time Netapp active Iq Unified Manager
Netapp oncommand Insight
Netty
Netty netty
Netapp
CWE NVD-CWE-noinfo
References () https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4 - () https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4 - Patch
References () https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw - () https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw - Vendor Advisory
References () https://security.netapp.com/advisory/ntap-20250221-0005/ - () https://security.netapp.com/advisory/ntap-20250221-0005/ - Third Party Advisory
References () https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-detection - () https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-detection - Exploit, Third Party Advisory
References () https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-mitigation - () https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-mitigation - Exploit, Mitigation, Third Party Advisory

16 Apr 2025, 16:15

Type Values Removed Values Added
References
  • () https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-detection -
  • () https://www.vicarius.io/vsociety/posts/cve-2025-24970-netty-vulnerability-mitigation -

21 Feb 2025, 18:15

Type Values Removed Values Added
Summary
  • (es) Netty, un framework de aplicación de red asincrónico y controlado por eventos, tiene una vulnerabilidad a partir de la versión 4.1.91.Final y anteriores a la versión 4.1.118.Final. Cuando se recibe un paquete especialmente manipulado a través de SslHandler, no se gestiona correctamente la validación de dicho paquete en todos los casos, lo que puede provocar un bloqueo nativo. La versión 4.1.118.Final contiene un parche. Como workaround, es posible deshabilitar el uso de SSLEngine nativo o cambiar el código manualmente.
References
  • () https://security.netapp.com/advisory/ntap-20250221-0005/ -

11 Feb 2025, 16:15

Type Values Removed Values Added
References () https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw - () https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw -

10 Feb 2025, 22:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-10 22:15

Updated : 2025-09-05 17:20

NVD link : CVE-2025-24970

Mitre link : CVE-2025-24970

CVE.ORG link : CVE-2025-24970

JSON object : View

Products Affected

netapp

  • oncommand_insight
  • active_iq_unified_manager

netty

  • netty
CWE
CWE-20

Improper Input Validation

NVD-CWE-noinfo