CVE-2016-4970: Loop with Unreachable Exit Condition in Netty
Summary
CVE-2016-4970: Loop with Unreachable Exit Condition in Netty. Affects io.netty:netty-handler across 2 version ranges.
>= 4.0.0.Alpha1, < 4.0.37.Final
>= 4.1.0.Beta1, < 4.1.1.Final
Fixed in 4.0.37.Final or 4.1.1.Final, depending on the release line you run. How to fix ↓
Also tracked for
- netty · Debian:11
The same CVE-2016-4970 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Netty is a popular open-source networking framework written in Java. It provides an asynchronous event-driven network application framework for rapid development of maintainable high-performance protocol servers and clients. Netty is widely used in various applications, including web servers, proxy servers, and network communication libraries. However, versions 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final of Netty are vulnerable to a denial of service (DoS) attack due to a loop with an unreachable exit condition in the OpenSslEngine class.
Vulnerability Detail
The vulnerability in Netty arises from a flaw in the OpenSslEngine class. Remote attackers can exploit this vulnerability to cause an infinite loop, resulting in a denial of service. By sending specially crafted network packets, an attacker can trigger the vulnerable code path, causing the affected Netty server or client to consume excessive CPU resources and become unresponsive. This can lead to a complete service outage and disruption of normal operations.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.0.0.Alpha1, < 4.0.37.Final4.0.37.Final -
>= 4.1.0.Beta1, < 4.1.1.Final4.1.1.Final
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the fixed versions is not immediately feasible, a temporary workaround can be implemented by disabling the affected functionality. In this case, the OpenSslEngine class should be excluded or replaced with an alternative implementation. However, this workaround may result in reduced functionality or performance, and it is strongly recommended to apply the official fix as soon as possible.
Conclusion
The vulnerability in Netty can lead to a denial of service (DoS) attack by causing an infinite loop. It is crucial to upgrade to the fixed versions of Netty (4.0.37.Final or later for 4.0.x, and 4.1.1.Final or later for 4.1.x) to mitigate this vulnerability. If immediate upgrade is not possible, a temporary workaround can be implemented by disabling the affected functionality. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.netty:netty-handler →
FAQ
Netty is an open-source networking framework written in Java that provides an asynchronous event-driven network application framework for rapid development of maintainable high-performance protocol servers and clients.
Versions 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final of Netty are affected by this vulnerability.
This vulnerability allows remote attackers to cause a denial of service (DoS) by triggering an infinite loop in the affected Netty server or client. This can lead to a complete service outage and disruption of normal operations.
To fix this vulnerability, it is recommended to upgrade to the fixed versions of Netty (4.0.37.Final or later for 4.0.x, and 4.1.1.Final or later for 4.1.x).
Yes, a temporary workaround is to disable the affected functionality by excluding or replacing the OpenSslEngine class. However, it is strongly recommended to apply the official fix as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for io.netty:netty-handler.
