{"id":"CVE-2016-4970","aliases":["DEBIAN-CVE-2016-4970","EUVD-2022-5233","GHSA-rv63-gqm8-9w8q","MGASA-2018-0485","UBUNTU-CVE-2016-4970"],"status":"published","title":"Loop with Unreachable Exit Condition in Netty","description":"handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite loop).","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.11259,"percentile":0.95996,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-835"],"published":"2017-04-13T14:00:00Z","modified":"2026-10-24T10:47:16Z","fixes":[{"ecosystem":"Maven","package":"io.netty:netty-handler","fixed_in":["4.0.37.Final","4.1.1.Final"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"netty","fixed_in":["1:4.0.37-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"netty","fixed_in":["1:4.0.37-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"netty","fixed_in":["1:4.0.37-1"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"netty","fixed_in":["4.0.42-1.mga6"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"jctools","fixed_in":["1.2.1-1.mga6"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0.Alpha1"},{"fixed":"4.0.37.Final"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0.Beta1"},{"fixed":"4.1.1.Final"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.0.37-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.0.37-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.0.37-1"}]}]},{"source":"osv","ecosystem":"Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0.Alpha1"},{"fixed":"4.0.37.Final"}]}],"versions":["4.0.0.Alpha1","4.0.0.Alpha2","4.0.0.Alpha3","4.0.0.Alpha4","4.0.0.Alpha5","4.0.0.Alpha6","4.0.0.Alpha7","4.0.0.Alpha8","4.0.0.Beta1","4.0.0.Beta2","4.0.0.Beta3","4.0.0.CR1","4.0.0.CR2","4.0.0.CR3","4.0.0.CR4","4.0.0.CR5","4.0.0.CR6","4.0.0.CR7","4.0.0.CR8","4.0.0.CR9","4.0.0.Final","4.0.1.Final","4.0.10.Final","4.0.11.Final","4.0.12.Final","4.0.13.Final","4.0.14.Beta1","4.0.14.Final","4.0.15.Final","4.0.16.Final","4.0.17.Final","4.0.18.Final","4.0.19.Final","4.0.2.Final","4.0.20.Final","4.0.21.Final","4.0.22.Final","4.0.23.Final","4.0.24.Final","4.0.25.Final","4.0.26.Final","4.0.27.Final","4.0.28.Final","4.0.29.Final","4.0.3.Final","4.0.30.Final","4.0.31.Final","4.0.32.Final","4.0.33.Final","4.0.34.Final","4.0.35.Final","4.0.36.Final","4.0.4.Final","4.0.5.Final","4.0.6.Final","4.0.7.Final","4.0.8.Final","4.0.9.Final"]},{"source":"osv","ecosystem":"Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0.Beta1"},{"fixed":"4.1.1.Final"}]}],"versions":["4.1.0.Beta1","4.1.0.Beta2","4.1.0.Beta3","4.1.0.Beta4","4.1.0.Beta5","4.1.0.Beta6","4.1.0.Beta7","4.1.0.Beta8","4.1.0.CR1","4.1.0.CR2","4.1.0.CR3","4.1.0.CR4","4.1.0.CR5","4.1.0.CR6","4.1.0.CR7","4.1.0.Final"]},{"source":"osv","ecosystem":"Mageia:6","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.42-1.mga6"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"jctools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-1.mga6"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.2.6.Final-2","1:4.0.32-1","1:4.0.33-1","1:4.0.34-1","1:4.0.34-1ubuntu0.1~esm1","1:4.0.34-1ubuntu0.1~esm2","1:4.0.34-1ubuntu0.1~esm3","1:4.0.34-1ubuntu0.1~esm4","1:4.0.34-1ubuntu0.1~esm5"]}],"products":[{"vendor":"apache","product":"cassandra"},{"vendor":"netty","product":"netty"},{"vendor":"redhat","product":"jboss_data_grid"},{"vendor":"redhat","product":"jboss_middleware_text-only_advisories"}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2017-0179.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2017-1097.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://netty.io/news/2016/06/07/4-1-1-Final.html","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory","advisory","web"]},{"url":"http://www.securityfocus.com/bid/96540","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://github.com/netty/netty/pull/5364","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://wiki.opendaylight.org/view/Security_Advisories","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://netty.io/news/2016/06/07/4-0-37-Final.html","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1343616","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","VDB Entry","report","web"]},{"url":"https://lists.apache.org/thread.html/afaa5860e3a6d327eb96c3d82cbd2f5996de815a16854ed1ad310144%40%3Ccommits.cassandra.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4970","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/afaa5860e3a6d327eb96c3d82cbd2f5996de815a16854ed1ad310144@%3Ccommits.cassandra.apache.org%3E","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rv63-gqm8-9w8q"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-4970","tags":["advisory"]},{"url":"https://github.com/netty/netty","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2018-0485.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23974","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-4970","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4970","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-4970","description":"handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite loop).","status":"published","published":"2017-04-13T14:00:00Z","modified":"2024-08-06T00:46:39.889Z","updated_at":"2026-11-02T14:33:34.815789Z"}],"euvd":[{"id":"EUVD-2022-5233","description":"handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite loop).","status":"published","published":"2017-04-13T14:00:00Z","modified":"2024-08-06T00:46:39Z","updated_at":"2026-11-03T02:22:44.489595Z"}],"ghsa":[{"id":"GHSA-rv63-gqm8-9w8q","title":"Loop with Unreachable Exit Condition in Netty","description":"handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite loop).","status":"published","published":"2022-05-13T01:11:43Z","modified":"2023-10-30T20:21:10Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:37:10.633403Z"}],"nvd":[{"id":"CVE-2016-4970","description":"handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite loop).","status":"published","published":"2017-04-13T14:59:01.823Z","modified":"2026-06-17T00:48:31.653Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.8,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:03:37.619685Z"}],"osv":[{"id":"CVE-2016-4970","description":"handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite loop).","status":"published","published":"2017-04-13T14:59:01.823Z","modified":"2026-10-24T10:47:16.532676477Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:02.454775Z"},{"id":"DEBIAN-CVE-2016-4970","description":"handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite loop).","status":"published","published":"2017-04-13T14:59:01.823Z","modified":"2026-09-22T07:01:55.148488485Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:27.627285Z"},{"id":"GHSA-rv63-gqm8-9w8q","title":"Loop with Unreachable Exit Condition in Netty","description":"handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite loop).","status":"published","published":"2022-05-13T01:11:43Z","modified":"2024-02-16T08:13:46.004283Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T15:46:56.281047Z"},{"id":"UBUNTU-CVE-2016-4970","description":"handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite loop).","status":"published","published":"2017-04-13T14:59:00Z","modified":"2026-08-20T00:00:16.794087046Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:12.261906Z"},{"id":"MGASA-2018-0485","title":"Updated netty \u0026 jctools packages fix security vulnerability","description":"handler/ssl/OpenSslEngine.java in Netty before 4.0.37.Final allows remote\nattackers to cause a denial of service (infinite loop) (CVE-2016-4970).\n","status":"published","published":"2018-12-20T20:17:27Z","modified":"2026-04-16T06:25:56.376314051Z","updated_at":"2026-11-02T15:49:40.793816Z"}]}}