Denial of Service Vulnerability in Netty Package: CVE-2016-4970
Summary
CVE-2016-4970: handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite loop). Affects netty across 3 version ranges.
< 1:4.0.37-1
>= 1709113a1f27be021e890d07c4d94576e2e7710c, < 4169779352fb91c69b41077033135a24f898ad1d
>= f9e033f519c14596da4dc954875756a69aea4e78, < 8d91b469afd3fcafef7ef85c10c8acc11703ba2d
Fixed in 1:4.0.37-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Netty is a popular asynchronous event-driven network application framework that enables quick and efficient development of network applications such as protocol servers and clients. It is widely used for its performance and scalability. However, certain versions of Netty are vulnerable to a denial of service attack due to an infinite loop in the OpenSslEngine component, which can be exploited by remote attackers.
Vulnerability Detail
The vulnerability identified as CVE-2016-4970 exists in the handler/ssl/OpenSslEngine.java file of Netty versions 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final. This flaw allows remote attackers to cause a denial of service by triggering an infinite loop, leading to application unresponsiveness. The vulnerability is critical as it can be exploited without authentication, making it a significant risk for applications using affected versions of Netty.
How To Fix
Minimum fixed version
1:4.0.37-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade nettyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing network-level protections such as rate limiting or IP whitelisting to mitigate the risk of exploitation until the package can be updated.
Conclusion
CVE-2016-4970 is a significant vulnerability in the Netty framework that can lead to denial of service attacks. It is crucial for developers and system administrators to update their Netty installations to the patched versions to mitigate this risk. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain the security of applications.
See every vulnerability recorded for netty →
FAQ
CVE-2016-4970 is a vulnerability in the Netty framework that allows remote attackers to cause a denial of service through an infinite loop in the OpenSslEngine component.
Netty versions 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final are affected by this vulnerability.
The vulnerability can lead to application unresponsiveness, making it unavailable to users and potentially causing significant downtime.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without needing to sign up.
The CVSS score for CVE-2016-4970 is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for netty.
