Most recent entries from all

bdu:2025-03389

certfr-2025-avi-0214 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2025-avi-0214

CLEANSTART-2026-BV69043 — Security fix for CVE-2025-24970 applied in: apache-hive 4.0.0-r0, apache-hive 4.2.0-r1, cassandra-reaper-fips 3.6.1-r3,…

Affected: CleanStart: apache-hive, CleanStart: cassandra-reaper-fips, CleanStart: stargate, CleanStart: wavefront-proxy

CVE-2025-24970 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

EUVD-2026-230743

fkie_cve-2025-24970

Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which can lead to a native crash. Version 4.1.118.Final contains a patch. As workaround its possible to either disable the usage of the native SSLEngine or change the code manually.

GHSA-4g8c-wm8x-jfhw — SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine

Affected: Maven: io.netty:netty-handler

### Impact When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which can lead to a native crash.

### Workarounds As workaround its possible to either disable the usage of the native SSLEngine or changing the code from:

``` SslContext context = ...; SslHandler handler = context.newHandler(....); ```

to:

``` SslContext context = ...; SSLEngine engine = context.newEngine(....); SslHandler handler = new SslHandler(engine, ....); ```

jvndb-2026-020740

Hitachi Infrastructure Analytics Advisor contains the following vulnerability: CVE-2025-48924 Hitachi Ops Center Analyzer contains the following vulnerabilities: CVE-2025-48924 Hitachi Ops Center Analyzer viewpoint contains the following vulnerability: CVE-2025-48924 Hitachi Ops Center Viewpoint contains the following vulnerabilities: CVE-2023-35116, CVE-2025-24970, CVE-2025-25193, CVE-2025-48924, CVE-2025-55163, CVE-2025-58056, CVE-2025-58057

openSUSE-SU-2025:14765-1 — netty-4.1.118-1.1 on GA media

netty-4.1.118-1.1 on GA media

RHSA-2025:12511 — Red Hat Security Advisory: Streams for Apache Kafka 3.0.0 release and security update

json-smart: Uncontrolled Resource Consumption vulnerability in json-smart (Resource Exhaustion) org.eclipse.jetty:jetty-http: jetty: Jetty URI parsing of invalid authority jetty-server: Jetty: Gzip Request Body Buffer Corruption kafka-clients: privilege escalation to filesystem read-access via automatic ConfigProvider netty: Denial of Service attack on windows app using Netty kafka: Apache Kafka: SCRAM authentication vulnerable to replay attacks when used without encryption io.quarkus:quarkus-resteasy: Memory Leak in Quarkus RESTEasy Classic When Client Requests Timeout io.netty:netty-handler: SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine netty: Denial of Service attack on windows app using Netty commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default commons-lang/commons-lang: org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang io.quarkus/quarkus-vertx: Quarkus potential data leak com.nimbusds/nimbus-jose-jwt: Uncontrolled recursion in Connect2id Nimbus JOSE + JWT

UBUNTU-CVE-2025-24970

Affected: Ubuntu:Pro:14.04:LTS: netty, Ubuntu:Pro:16.04:LTS: netty, Ubuntu:Pro:18.04:LTS: netty, Ubuntu:Pro:20.04:LTS: netty, Ubuntu:Pro:22.04:LTS: netty, Ubuntu:Pro:24.04:LTS: netty, Ubuntu:25.10: netty, Ubuntu:Pro:26.04:LTS: netty

WID-SEC-W-2025-0460 — Red Hat Enterprise Linux (Quarkus): Mehrere Schwachstellen

Ein entfernter Angreifer kann mehrere Schwachstellen in Quarkus auf Red Hat Enterprise Linux ausnutzen, um Informationen offenzulegen, oder einen Denial of Service auszulösen.