CVE-2024-47535

Description

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attempts to load a file that does not exist. If an attacker creates such a large file, the Netty application crashes. This vulnerability is fixed in 4.1.115.

CVSS Metrics

• v4.0•MEDIUM•Score: 6.8CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
• v3.1•MEDIUM•Score: 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.47%• Percentile: 65%

Techniques & Countermeasures

• CWE-400•Uncontrolled Resource Consumption

  The product does not properly control the allocation and maintenance of a limited resource.

Affected Systems

• io.netty•netty-common

  < 4.1.115.Final

• netty•netty

  < 4.1.115

References (4)

• https://github.com/netty/netty/security/advisories/GHSA-xq3w-v528-46rv
• https://github.com/netty/netty/commit/fbf7a704a82e7449b48bd0bbb679f5661c6d61a3
• https://nvd.nist.gov/vuln/detail/CVE-2024-47535
• https://github.com/netty/netty