Netty, an asynchronous, event-driven network application framework, has a vulnerability in versions up to and including 4.1.118.Final. An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attempts to load a file that does not exist. If an attacker creates such a large file, the Netty application crash. A similar issue was previously reported as CVE-2024-47535. This issue was fixed, but the fix was incomplete in that null-bytes were not counted against the input limit. Commit d1fbda62d3a47835d3fb35db8bd42ecc205a5386 contains an updated fix.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Dell Powerstore Dsa2025342 | dell-powerstoreos-upgrade-latest | Oct 23, 2025 | Sep 2, 2025 | |
| Dell Powerstore Dsa2026039 | dell-powerstoreos-upgrade-latest | Jan 13, 2026 | Jan 6, 2026 | |
| Ibm Was | ibm-was-upgrade-latest | Apr 23, 2025 | Feb 10, 2025 | |
| Red Hat Jboss Eap | red-hat-jboss-eap-upgrade-latest | Mar 13, 2025 | Feb 10, 2025 | |
| Suse | — | suse-upgrade-nettysuse-upgrade-netty-javadocsuse-upgrade-netty-tcnativesuse-upgrade-netty-tcnative-javadoc | Feb 21, 2025 | Feb 10, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub