CVE-2024-47535 Security Details

CVE ID

CVE-2024-47535

CWE

CWE-400

CVE Description

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attempts to load a file that does not exist. If an attacker creates such a large file, the Netty application crashes. This vulnerability is fixed in 4.1.115.

Published

Nov 13, 2024

CVSS Score & Severity

6.8Medium

CVSS Vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L

EPSS Score

0.467%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

io/netty/util/NetUtil$1.run()Ljava/lang/Integer;

JVM

io/netty/util/NetUtil$SoMaxConnAction.run()Ljava/lang/Integer;

JVM

io/netty/util/NetUtil.<clinit>()V

JVM

io/netty/util/internal/PlatformDependent.addFilesystemOsClassifiers(Ljava/util/Set;Ljava/util/Set;)V

JVM

Affected Ecosystems

affected

Source

National Vulnerability Database

References

GitHub · Advisory · GHSA-xq3w-v528-46rvPROJECT