CVE-2025-24970: Vulnerability in io.netty:netty-handler Leading to Native Crash
Summary
CVE-2025-24970: Impact When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which can lead to a native crash. Affects io.netty:netty-handler versions >= 4.1.91.Final, < 4.1.118.Final. Fixed in 4.1.118.Final. How to fix ↓
Also tracked for
- netty · Debian:12
The same CVE-2025-24970 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The io.netty:netty-handler package is a widely used component in Java applications for handling network communication. It provides essential functionalities such as SSL/TLS support through its SslHandler class, which is crucial for secure data transmission. However, this package has been identified to have a vulnerability that can lead to severe consequences if exploited, particularly when using the native SSLEngine.
Vulnerability Detail
The vulnerability arises from the SslHandler's failure to properly validate specially crafted packets in certain scenarios. This oversight can lead to a native crash, compromising the stability and security of applications utilizing this package. The issue is particularly concerning for applications that rely on secure communications, as it could potentially allow attackers to disrupt service or exploit the crash for further malicious activities.
How To Fix
Latest published version: 5.0.0.Alpha2 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.1.118.Final
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the usage of the native SSLEngine or modify your code to use a custom SSLEngine instance. Here’s how you can change your code:
SslContext context = ...; SSLEngine engine =
context.newEngine(...);
SslHandler handler = new
SslHandler(engine, ...);
Conclusion
In summary, CVE-2025-24970 is a significant vulnerability in the io.netty:netty-handler package that can lead to native crashes due to improper packet validation. It is crucial for developers to update to the patched version or implement the suggested workarounds to mitigate risks.
See every vulnerability recorded for io.netty:netty-handler →
FAQ
CVE-2025-24970 is a vulnerability in the io.netty:netty-handler package that can lead to a native crash when improperly validated packets are processed.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
Exploiting this vulnerability can lead to application crashes, service disruptions, and potential exploitation of the crash for further attacks.
Yes, the vulnerability has been patched in version 4.1.118.Final of the io.netty:netty-handler package.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.netty:netty-handler.
