CVE-2016-4970 Loop with Unreachable Exit Condition in Netty
Remote attackers can cause a denial of service via an infinite loop in the Netty SSL engine, requiring an upgrade to the library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-4970?
CVE-2016-4970 is a high-severity denial of service vulnerability in Netty Netty, published on 13 Apr 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite loop).
Weakness: CWE-835
Which versions are affected by CVE-2016-4970?
4 open source packages ship an affected version, including io.netty:netty-handler. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
io.netty:netty-handler Maven | From 4.0.0.Alpha1 | 4.0.37.Final |
io.netty:netty-handler Maven | From 4.0.0.Alpha1 | 4.0.37.Final |
io.netty:netty-handler Maven | From 4.1.0.Beta1 | 4.1.1.Final |
io.netty:netty-handler Maven | From 4.1.0.Beta1 | 4.1.1.Final |
Products include Apache Cassandra, Netty Netty, Redhat Jboss Data Grid, Redhat Jboss Middleware Text-Only Advisories.
How do I fix CVE-2016-4970?
Upgrade io.netty:netty-handler to a fixed version for your release line: 4.0.37.Final or 4.1.1.Final.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2016-4970 being exploited?
There is no known exploitation of CVE-2016-4970 in the wild and no public exploit code.
Other vulnerabilities in Netty Netty
- CVE-2016-3427 Oracle Java SE and JRockit Unspecified
- CVE-2018-8016 Missing Authentication for Critical Function in Apache Cassandra
- CVE-2021-44521 Remote code execution for scripted UDFs
- CVE-2026-27314 Apache Cassandra: Privilege escalation via ADD IDENTITY authorization bypass
- CVE-2025-26467 Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions (4.0.16 only)
Sources
Also known as DEBIAN-CVE-2016-4970, GHSA-rv63-gqm8-9w8q, MGASA-2018-0485, UBUNTU-CVE-2016-4970.