7.8

CVE-2016-4970: apache cassandra Infinite Loop

CVSS: 7.8v2.0HighModified
AliasesMGASA-2018-0485UBUNTU-CVE-2016-4970DEBIAN-CVE-2016-4970
Published 13-04-2017Last modified 06-08-2024
Open JSON

Vulnerability summary

CVE-2016-4970 is a high (CVSS 7.8) Infinite Loop vulnerability in apache cassandra. EPSS estimates a 11.26% chance of exploitation in the next 30 days, higher than 95.9% of scored vulnerabilities.

Overall risk
33/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v2.0 (NVD)
EPSS score
11.26%
0%100%
Medium · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 13-04-2017
    PublishedVulnerability first disclosed.
  2. 06-08-2024
    Last modifiedVulnerability information updated.

Description

handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite loop).

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

11.26%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

0.00 pp

From 11.26% on 18-09-2026

18-09-202618-10-2026
EPSS score
11.26%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Mageia2 products
  • jctools< 1.2.1-1.mga6
  • netty< 4.0.42-1.mga6
Redhat2 products
Apache1 product
Debian1 product
  • netty< 1:4.0.37-1
Io.netty1 product
  • netty-handler≥ 4.0.0.Alpha1, < 4.0.37.Final | ≥ 4.1.0.Beta1, < 4.1.1.Final
Netty1 product
  • netty≥ 4.0.20, < 4.0.37 | ≥ 4.1.0, < 4.1.1
Ubuntu1 product
  • nettyAll versions (No fix recorded)

7 vendors · 9 products

References

17 links
Show all 17 references