Vulnerability · Published Nov 12, 2024 · Assigned by GitHub_M

CVE-2024-47535Denial of Service attack on windows app using Netty

Medium 5.5

In plain English

A medium-severity uncontrolled resource consumption in netty from netty. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)0.4%top 64.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attempts to load a file that does not exist. If an attacker creates such a large file, the Netty application crashes. This vulnerability is fixed in 4.1.115.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	io.netty:netty-common	4.1.115.Final	GHSA-xq3w-v528-46rv
Ubuntu:22.04:LTS	netty	no fix listed	UBUNTU-CVE-2024-47535
Ubuntu:24.04:LTS	netty	no fix listed	UBUNTU-CVE-2024-47535
Ubuntu:25.10	netty	no fix listed	UBUNTU-CVE-2024-47535
Ubuntu:26.04:LTS	netty	no fix listed	UBUNTU-CVE-2024-47535
Ubuntu:26.10	netty	no fix listed	UBUNTU-CVE-2024-47535

Affected products (as reported)

Vendor	Product	Versions
netty	netty	< 4.1.115

Weakness: CWE-400 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/netty/netty/security/advisories/GHSA-xq3w-v528-46rv x_refsource_CONFIRM
https://github.com/netty/netty/commit/fbf7a704a82e7449b48bd0bbb679f5661c6d61a3 x_refsource_MISC