CVE-2025-24970

Name	CVE-2025-24970
Description	Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which can lead to a native crash. Version 4.1.118.Final contains a patch. As workaround its possible to either disable the usage of the native SSLEngine or change the code manually.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
netty (PTS)	bullseye (security), bullseye	1:4.1.48-4+deb11u2	fixed
	bookworm, bookworm (security)	1:4.1.48-7+deb12u1	vulnerable
	sid, trixie	1:4.1.48-10	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
netty	source	bullseye	(not affected)
netty	source	(unstable)	(unfixed)

Notes

[bullseye] - netty <not-affected> (Vulnerable code not present)
https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw
Fixed by: https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4 (netty-4.1.118.Final)