CVE-2025-24970 SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine
A crafted packet can cause a native crash in Netty's SslHandler when using the native SSLEngine, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-24970?
CVE-2025-24970 is a high-severity denial of service vulnerability in Netapp Active Iq Unified Manager, published on 10 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which can lead to a native crash. Version 4.1.118.Final contains a patch. As workaround its possible to either disable the usage of the native SSLEngine or change the code manually.
Weakness: CWE-20
Which versions are affected by CVE-2025-24970?
2 open source packages ship an affected version, including io.netty:netty-handler. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
io.netty:netty-handler Maven | From 4.1.91.Final | 4.1.118.Final |
io.netty:netty-handler Maven | From 4.1.91.Final | 4.1.118.Final |
Products include Netapp Active Iq Unified Manager, Netapp Oncommand Insight, Netty Netty.
How do I fix CVE-2025-24970?
Upgrade io.netty:netty-handler to 4.1.118.Final or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-24970 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-24970 exists.
Other vulnerabilities in Netapp Active Iq Unified Manager
Sources
Also known as CLEANSTART-2026-BV69043, CLEANSTART-2026-ZA32315, CLSA-2025-1754611416, ECHO-1d8b-58fb-4712, GHSA-4g8c-wm8x-jfhw, MINI-2863-rqmc-2fqj and 17 more.