CVE-2025-24970

Impact

When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which can lead to a native crash.

Workarounds

As workaround its possible to either disable the usage of the native SSLEngine or changing the code from:

SslContext context = ...;
SslHandler handler = context.newHandler(....);

to:

SslContext context = ...;
SSLEngine engine = context.newEngine(....);
SslHandler handler = new SslHandler(engine, ....);

A client might overload the server by issue frequent RST frames. This can cause a massive amount of load on the remote system and so cause a DDOS attack.

Impact

This is a DDOS attack, any http2 server is affected and so you should update as soon as possible.

Patches

This is patched in version 4.1.100.Final.

Workarounds

A user can limit the amount of RST frames that are accepted per connection over a timeframe manually using either an own Http2FrameListener implementation or an ChannelInboundHandler implementation (depending which http2 API is used).

References

• https://www.cve.org/CVERecord?id=CVE-2023-44487
• https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
• https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/

Red Hat Lightwell has released io.netty:netty-handler 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2025-24970, CVE-2026-44249, CVE-2026-45416, CVE-2026-50010, CVE-2026-75595, and CVE-2026-75596.

CVE-2025-24970: SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine

CVE-2026-44249: Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking

CVE-2026-45416: Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes

CVE-2026-50010: Netty's wrapping plain trust manager silently disables hostname verification

CVE-2026-75595: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext

CVE-2026-75596: Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing

This patched artifact is a drop-in replacement for io.netty:netty-handler 4.1.100.Final from Maven Central.

Root has patched CVE-2025-24970 in the io.root.io.netty:netty-handler package for Root:Maven. Multiple fixed versions available.

Root has patched GHSA-xpw8-rcwv-8f8p in the io.root.io.netty:netty-codec-http2 package for Root:Maven. Multiple fixed versions available.

Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which can lead to a native crash. Version 4.1.118.Final contains a patch. As workaround its possible to either disable the usage of the native SSLEngine or change the code manually.

TuxCare rebuilt io.netty:netty-handler to address 1 CVE. Fixed in 4.1.115.Final-tuxcare.1.

TuxCare rebuilt 4 io.netty packages to address 5 CVEs. Fixed in 4.1.112.Final-tuxcare.1.

TuxCare rebuilt 2 io.netty packages to address 2 CVEs. Fixed in 4.1.63.Final-tuxcare.3.

TuxCare rebuilt 40 io.netty packages to address 5 CVEs. Fixed in 4.1.48.Final-tuxcare.1.

TuxCare rebuilt 40 io.netty packages to address 9 CVEs. Fixed in 4.1.49.Final-tuxcare.1.

TuxCare rebuilt 46 io.netty packages to address 6 CVEs. Fixed in 4.1.82.Final-tuxcare.1.

TuxCare rebuilt 6 io.netty packages to address 9 CVEs. Fixed in 4.1.58.Final-tuxcare.1.

TuxCare rebuilt 43 io.netty packages to address 15 CVEs. Fixed in 4.1.60.Final-tuxcare.1.

TuxCare rebuilt 46 io.netty packages to address 9 CVEs. Fixed in 4.1.75.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 12 CVEs. Fixed in 4.1.93.Final-tuxcare.1.

TuxCare rebuilt 46 io.netty packages to address 6 CVEs. Fixed in 4.1.73.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 7 CVEs. Fixed in 4.1.92.Final-tuxcare.1.

TuxCare rebuilt 5 io.netty packages to address 8 CVEs. Fixed in 4.1.117.Final-tuxcare.2.

TuxCare rebuilt 47 io.netty packages to address 62 CVEs. Fixed in 4.1.111.Final-tuxcare.1.

TuxCare rebuilt 7 io.netty packages to address 8 CVEs. Fixed in 4.1.79.Final-tuxcare.1.

TuxCare rebuilt 4 io.netty packages to address 4 CVEs. Fixed in 4.1.94.Final-tuxcare.2.

TuxCare rebuilt 2 io.netty packages to address 2 CVEs. Fixed in 4.1.108.Final-tuxcare.2.

TuxCare rebuilt 7 io.netty packages to address 11 CVEs. Fixed in 4.1.52.Final-tuxcare.3.

TuxCare rebuilt 38 io.netty packages to address 5 CVEs. Fixed in 4.1.43.Final-tuxcare.2.

TuxCare rebuilt 47 io.netty packages to address 19 CVEs. Fixed in 4.1.99.Final-tuxcare.1.

TuxCare rebuilt 4 io.netty packages to address 4 CVEs. Fixed in 4.1.107.Final-tuxcare.2.

TuxCare rebuilt 46 io.netty packages to address 19 CVEs. Fixed in 4.1.80.Final-tuxcare.1.

TuxCare rebuilt 6 io.netty packages to address 13 CVEs. Fixed in 4.1.42.Final-tuxcare.1.

TuxCare rebuilt 3 io.netty packages to address 3 CVEs. Fixed in 4.1.87.Final-tuxcare.2.

TuxCare rebuilt 47 io.netty packages to address 19 CVEs. Fixed in 4.1.96.Final-tuxcare.1.

TuxCare rebuilt 9 io.netty packages to address 13 CVEs. Fixed in 4.1.81.Final-tuxcare.1.

TuxCare rebuilt 15 io.netty packages to address 27 CVEs. Fixed in 4.1.72.Final-tuxcare.1.

TuxCare rebuilt 43 io.netty packages to address 25 CVEs. Fixed in 4.1.68.Final-tuxcare.1.

TuxCare rebuilt 13 io.netty packages to address 24 CVEs. Fixed in 4.1.114.Final-tuxcare.1.

TuxCare rebuilt 10 io.netty packages to address 15 CVEs. Fixed in 4.1.113.Final-tuxcare.1.

TuxCare rebuilt 40 io.netty packages to address 26 CVEs. Fixed in 4.1.53.Final-tuxcare.1.

TuxCare rebuilt 11 io.netty packages to address 21 CVEs. Fixed in 4.1.51.Final-tuxcare.1.

TuxCare rebuilt 6 io.netty packages to address 6 CVEs. Fixed in 4.1.76.Final-tuxcare.1.

TuxCare rebuilt 7 io.netty packages to address 10 CVEs. Fixed in 4.1.21.Final-tuxcare.1.

TuxCare rebuilt 3 io.netty packages to address 4 CVEs. Fixed in 4.0.56.Final-tuxcare.1.

TuxCare rebuilt 13 io.netty packages to address 24 CVEs. Fixed in 4.1.74.Final-tuxcare.1.

TuxCare rebuilt 8 io.netty packages to address 12 CVEs. Fixed in 4.1.101.Final-tuxcare.2.

TuxCare rebuilt 2 io.netty packages to address 2 CVEs. Fixed in 4.1.29.Final-tuxcare.4.