CVE-2024-47535: Denial of Service attack on windows app using Netty

Analyzed

AliasesSUSE-SU-2024:4407-1SUSE-SU-2025:01994-1UBUNTU-CVE-2024-47535+409 more

Published 12-11-2024Last modified 13-11-2024

Vulnerability summary

CVE-2024-47535 is a medium (CVSS 5.5) Uncontrolled Resource Consumption vulnerability in netty. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 35.1% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Routine

Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.5/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.41%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1github

Timeline

12-11-2024
PublishedVulnerability first disclosed.
13-11-2024
Last modifiedVulnerability information updated.

Description

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attempts to load a file that does not exist. If an attacker creates such a large file, the Netty application crashes. This vulnerability is fixed in 4.1.115.

CVSS metrics

7 scores · 6 sources · 2 versions

v4.06.8v3.15.5

EPSS trend

Probability

0.41%

Chance of exploitation in the next 30 days

Percentile

35%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.41% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

githubUnverified
Netty
Maturity: poc

Weaknesses

CWE · root cause

CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard200 products

akhqAll versions (No fix recorded)
apache-nifiAll versions (No fix recorded)
apache-nifi-compatAll versions (No fix recorded)
apache-nifi-toolkitAll versions (No fix recorded)
apicurio-registry< 3.0.6-r1

apicurio-registry-nginx-config< 3.0.6-r1
apicurio-registry-ui< 3.0.6-r1
cassandra-5.0All versions (No fix recorded)
cassandra-5.0-compatAll versions (No fix recorded)
cassandra-5.0-entrypoint-compatAll versions (No fix recorded)
cassandra-5.0-iamguarded-compatAll versions (No fix recorded)
cassandra-fips-5.0All versions (No fix recorded)
cassandra-fips-5.0-compatAll versions (No fix recorded)
cassandra-reaperAll versions (No fix recorded)
celeborn-0.5< 0.5.4-r26
cloudwatch-exporterAll versions (No fix recorded)
confluent-kafkaAll versions (No fix recorded)
confluent-kafka-jre-bcfipsAll versions (No fix recorded)
cqlsh-5.0All versions (No fix recorded)
cqlsh-fips-5.0All versions (No fix recorded)
docker-seleniumAll versions (No fix recorded)
docker-selenium-baseAll versions (No fix recorded)
docker-selenium-compatAll versions (No fix recorded)
docker-selenium-distributorAll versions (No fix recorded)
docker-selenium-event-busAll versions (No fix recorded)
docker-selenium-hubAll versions (No fix recorded)
docker-selenium-node-baseAll versions (No fix recorded)
docker-selenium-node-chromiumAll versions (No fix recorded)
docker-selenium-node-dockerAll versions (No fix recorded)
docker-selenium-node-firefoxAll versions (No fix recorded)
docker-selenium-routerAll versions (No fix recorded)
docker-selenium-session-queueAll versions (No fix recorded)
docker-selenium-sessionsAll versions (No fix recorded)
docker-selenium-standaloneAll versions (No fix recorded)
docker-selenium-standalone-chromeAll versions (No fix recorded)
docker-selenium-standalone-chromiumAll versions (No fix recorded)
docker-selenium-standalone-dockerAll versions (No fix recorded)
docker-selenium-standalone-firefoxAll versions (No fix recorded)
docker-selenium-supervisor-configAll versions (No fix recorded)
druidAll versions (No fix recorded)
druid-compatAll versions (No fix recorded)
elasticsearch-7All versions (No fix recorded)
elasticsearch-7-iamguardedAll versions (No fix recorded)
grpc-java-fips-1.56.0All versions (No fix recorded)
grpc-java-fips-1.56.0-m2All versions (No fix recorded)
hadoop-fips-3.4.2All versions (No fix recorded)
kafka_exporter-strimzi-compatAll versions (No fix recorded)
kafka-3.7All versions (No fix recorded)
kafka-3.8All versions (No fix recorded)
kafka-3.9All versions (No fix recorded)
kafka-strimzi-compatAll versions (No fix recorded)
keycloak< 26.0.5-r1
knative-kafka-broker-1.17-dispatcher-loom< 1.17.3-r8
knative-kafka-broker-1.17-receiver-loom< 1.17.3-r8
kserve-modelmeshAll versions (No fix recorded)
kserve-modelmesh-compatAll versions (No fix recorded)
logstash-8-with-output-opensearchAll versions (No fix recorded)
management-api-for-apache-cassandra-4.0All versions (No fix recorded)
management-api-for-apache-cassandra-4.0-compatAll versions (No fix recorded)
management-api-for-apache-cassandra-4.1All versions (No fix recorded)
management-api-for-apache-cassandra-4.1-compatAll versions (No fix recorded)
management-api-for-apache-cassandra-5.0All versions (No fix recorded)
management-api-for-apache-cassandra-5.0-compatAll versions (No fix recorded)
opensearch-2All versions (No fix recorded)
opensearch-2-alertingAll versions (No fix recorded)
opensearch-2-analysis-icuAll versions (No fix recorded)
opensearch-2-analysis-kuromojiAll versions (No fix recorded)
opensearch-2-analysis-noriAll versions (No fix recorded)
opensearch-2-analysis-phoneticAll versions (No fix recorded)
opensearch-2-analysis-smartcnAll versions (No fix recorded)
opensearch-2-analysis-stempelAll versions (No fix recorded)
opensearch-2-analysis-ukrainianAll versions (No fix recorded)
opensearch-2-anomaly-detectionAll versions (No fix recorded)
opensearch-2-asynchronous-searchAll versions (No fix recorded)
opensearch-2-cross-cluster-replicationAll versions (No fix recorded)
opensearch-2-crypto-kmsAll versions (No fix recorded)
opensearch-2-custom-codecsAll versions (No fix recorded)
opensearch-2-discovery-azure-classicAll versions (No fix recorded)
opensearch-2-discovery-ec2All versions (No fix recorded)
opensearch-2-discovery-gceAll versions (No fix recorded)
opensearch-2-entrypoint-compatAll versions (No fix recorded)
opensearch-2-geospatialAll versions (No fix recorded)
opensearch-2-identity-shiroAll versions (No fix recorded)
opensearch-2-index-managementAll versions (No fix recorded)
opensearch-2-ingest-attachmentAll versions (No fix recorded)
opensearch-2-job-schedulerAll versions (No fix recorded)
opensearch-2-k-nnAll versions (No fix recorded)
opensearch-2-mapper-annotated-textAll versions (No fix recorded)
opensearch-2-mapper-murmur3All versions (No fix recorded)
opensearch-2-mapper-sizeAll versions (No fix recorded)
opensearch-2-ml-commonsAll versions (No fix recorded)
opensearch-2-neural-searchAll versions (No fix recorded)
opensearch-2-notificationsAll versions (No fix recorded)
opensearch-2-observabilityAll versions (No fix recorded)
opensearch-2-performance-analyzerAll versions (No fix recorded)
opensearch-2-reportingAll versions (No fix recorded)
opensearch-2-repository-azureAll versions (No fix recorded)
opensearch-2-repository-gcsAll versions (No fix recorded)
opensearch-2-repository-s3All versions (No fix recorded)
opensearch-2-securityAll versions (No fix recorded)
opensearch-2-security-analyticsAll versions (No fix recorded)
opensearch-2-sqlAll versions (No fix recorded)
opensearch-2-store-smbAll versions (No fix recorded)
opensearch-2-telemetry-otelAll versions (No fix recorded)
opensearch-2-transport-nioAll versions (No fix recorded)
prometheus-jmx-exporter-strimzi-compatAll versions (No fix recorded)
seata-server< 2.7.0-r3
seleniumAll versions (No fix recorded)
selenium-serverAll versions (No fix recorded)
selenium-server-compatAll versions (No fix recorded)
selenium-server-standaloneAll versions (No fix recorded)
solrAll versions (No fix recorded)
solr-oci-compatAll versions (No fix recorded)
sonarqube< 25.6.0.109173-r0
sonarqube-10All versions (No fix recorded)
sonarqube-docker-compat< 25.6.0.109173-r0
sonarqube-scripts< 25.6.0.109173-r0
spark-3.5All versions (No fix recorded)
spark-3.5-scala-2.12All versions (No fix recorded)
spark-3.5-scala-2.12-compatAll versions (No fix recorded)
spark-3.5-scala-2.12-iamguarded-compatAll versions (No fix recorded)
spark-3.5-scala-2.13All versions (No fix recorded)
spark-3.5-scala-2.13-compatAll versions (No fix recorded)
strimzi-kafka-operatorAll versions (No fix recorded)
strimzi-kafka-operator-cluster-operatorAll versions (No fix recorded)
strimzi-kafka-operator-kafka-agentAll versions (No fix recorded)
strimzi-kafka-operator-kafka-baseAll versions (No fix recorded)
strimzi-kafka-operator-kafka-initAll versions (No fix recorded)
strimzi-kafka-operator-kafka-thirdparty-libsAll versions (No fix recorded)
strimzi-kafka-operator-kafka-thirdparty-libs-ccAll versions (No fix recorded)
strimzi-kafka-operator-topic-operatorAll versions (No fix recorded)
strimzi-kafka-operator-tracing-agentAll versions (No fix recorded)
strimzi-kafka-operator-user-operatorAll versions (No fix recorded)
tezAll versions (No fix recorded)
thingsboardAll versions (No fix recorded)
thingsboard-tb-js-executorAll versions (No fix recorded)
thingsboard-tb-mqtt-transportAll versions (No fix recorded)
thingsboard-tb-nodeAll versions (No fix recorded)
thingsboard-tb-web-uiAll versions (No fix recorded)
trinoAll versions (No fix recorded)
trino-configAll versions (No fix recorded)
trino-oci-entrypointAll versions (No fix recorded)
trino-plugin-ai-functionsAll versions (No fix recorded)
trino-plugin-bigqueryAll versions (No fix recorded)
trino-plugin-blackholeAll versions (No fix recorded)
trino-plugin-cassandraAll versions (No fix recorded)
trino-plugin-clickhouseAll versions (No fix recorded)
trino-plugin-delta-lakeAll versions (No fix recorded)
trino-plugin-druidAll versions (No fix recorded)
trino-plugin-duckdbAll versions (No fix recorded)
trino-plugin-elasticsearchAll versions (No fix recorded)
trino-plugin-exasolAll versions (No fix recorded)
trino-plugin-exchange-filesystemAll versions (No fix recorded)
trino-plugin-exchange-hdfsAll versions (No fix recorded)
trino-plugin-fakerAll versions (No fix recorded)
trino-plugin-functions-pythonAll versions (No fix recorded)
trino-plugin-geospatialAll versions (No fix recorded)
trino-plugin-google-sheetsAll versions (No fix recorded)
trino-plugin-hiveAll versions (No fix recorded)
trino-plugin-http-event-listenerAll versions (No fix recorded)
trino-plugin-http-server-event-listenerAll versions (No fix recorded)
trino-plugin-hudiAll versions (No fix recorded)
trino-plugin-icebergAll versions (No fix recorded)
trino-plugin-igniteAll versions (No fix recorded)
trino-plugin-jmxAll versions (No fix recorded)
trino-plugin-kafkaAll versions (No fix recorded)
trino-plugin-kafka-event-listenerAll versions (No fix recorded)
trino-plugin-lakehouseAll versions (No fix recorded)
trino-plugin-ldap-group-providerAll versions (No fix recorded)
trino-plugin-lokiAll versions (No fix recorded)
trino-plugin-mariadbAll versions (No fix recorded)
trino-plugin-memoryAll versions (No fix recorded)
trino-plugin-mlAll versions (No fix recorded)
trino-plugin-mongodbAll versions (No fix recorded)
trino-plugin-mysqlAll versions (No fix recorded)
trino-plugin-mysql-event-listenerAll versions (No fix recorded)
trino-plugin-opaAll versions (No fix recorded)
trino-plugin-openlineageAll versions (No fix recorded)
trino-plugin-opensearchAll versions (No fix recorded)
trino-plugin-oracleAll versions (No fix recorded)
trino-plugin-password-authenticatorsAll versions (No fix recorded)
trino-plugin-pinotAll versions (No fix recorded)
trino-plugin-postgresqlAll versions (No fix recorded)
trino-plugin-prometheusAll versions (No fix recorded)
trino-plugin-rangerAll versions (No fix recorded)
trino-plugin-redisAll versions (No fix recorded)
trino-plugin-redshiftAll versions (No fix recorded)
trino-plugin-resource-group-managersAll versions (No fix recorded)
trino-plugin-session-property-managersAll versions (No fix recorded)
trino-plugin-singlestoreAll versions (No fix recorded)
trino-plugin-snowflakeAll versions (No fix recorded)
trino-plugin-spooling-filesystemAll versions (No fix recorded)
trino-plugin-sqlserverAll versions (No fix recorded)
trino-plugin-teradata-functionsAll versions (No fix recorded)
trino-plugin-thriftAll versions (No fix recorded)
trino-plugin-tpcdsAll versions (No fix recorded)
trino-plugin-tpchAll versions (No fix recorded)
trino-plugin-verticaAll versions (No fix recorded)
wavefront-proxyAll versions (No fix recorded)
wavefront-proxy-compatAll versions (No fix recorded)

Show all 200

1 vendor · 200 products · Showing 200 of 364

References

14 links

github.com/netty/netty/security/advisories/GHSA-xq3w-v528-46rvX Refsource CONFIRMREPORTAdvisoryWEBExploitVendor Advisory
github.com/netty/netty/commit/fbf7a704a82e7449b48bd0bbb679f5661c6d61a3X Refsource MISCREPORTFIXWEBPatch
www.suse.com/support/update/announcement/2024/suse-su-20244407-1/Advisory
bugzilla.suse.com/1047218REPORT
bugzilla.suse.com/1233297REPORT
www.suse.com/security/cve/CVE-2024-47535WEB
www.suse.com/support/update/announcement/2025/suse-su-202501994-1/Advisory
bugzilla.suse.com/1230585REPORT
ubuntu.com/security/CVE-2024-47535REPORT
www.cve.org/CVERecord?id=CVE-2024-47535REPORT

Show all 14 references

github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47535.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2024-47535Advisory
lists.opensuse.org/archives/…Advisory
github.com/netty/nettyPACKAGE