{"id":"CVE-2025-25193","published":"2025-02-10T22:02:17Z","modified":"2025-02-21T18:03:38Z","title":"Denial of Service attack on windows app using Netty","vendor":"netty","product":"netty","tier":"tail","description":{"text":"Netty, an asynchronous, event-driven network application framework, has a vulnerability in versions up to and including 4.1.118.Final. An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attempts to load a file that does not exist. If an attacker creates such a large file, the Netty application crash. A similar issue was previously reported as CVE-2024-47535. This issue was fixed, but the fix was incomplete in that null-bytes were not counted against the input limit. Commit d1fbda62d3a47835d3fb35db8bd42ecc205a5386 contains an updated fix.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.5,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00391,"percentile":0.33248,"provenance":"source"},"cwes":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"references":[{"url":"https://github.com/netty/netty/security/advisories/GHSA-389x-839f-4rhx","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/netty/netty/commit/d1fbda62d3a47835d3fb35db8bd42ecc205a5386","tags":["x_refsource_MISC"]},{"url":"https://security.netapp.com/advisory/ntap-20250221-0006/","tags":[]}],"priority":{"score":10.5,"factors":[{"name":"EPSS percentile","points":6.65},{"name":"CVSS severity","points":3.85}]},"vendorSlug":"netty","affectedVersions":[{"vendor":"netty","product":"netty","versions":["<= 4.1.118"]}],"affected":[{"ecosystem":"Maven","package":"io.netty:netty-common","vulnerableRanges":["<4.1.118.Final"],"patched":["4.1.118.Final"],"from":["GHSA-389x-839f-4rhx"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-4081","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-netty-cve-2021-21290","parents":[{"from":"CVE-2024-47535","to":"CVE-2025-25193","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"related","quote":"A similar issue was previously reported as CVE-2024-47535.","from":"CVE.org","in":"CVE-2025-25193"},{"kind":"version-step","provenance":"source","package":"Maven:io.netty:netty-common","fromFixed":"4.1.115.Final","toFixed":"4.1.118.Final","daysApart":90},{"kind":"same-code","provenance":"machine","files":["common/src/main/java/io/netty/util/internal/BoundedInputStream.java"],"commits":["https://github.com/netty/netty/commit/fbf7a704a82e7449b48bd0bbb679f5661c6d61a3","https://github.com/netty/netty/commit/d1fbda62d3a47835d3fb35db8bd42ecc205a5386"],"basis":"rarely changed file"},{"kind":"similar","provenance":"machine","score":0.42,"basis":"same product + CWE + description similarity"}]}],"packageHistory":[{"cve":"CVE-2024-47535","published":"2024-11-12","fixed":"4.1.115.Final","kev":false},{"cve":"CVE-2025-25193","published":"2025-02-10","fixed":"4.1.118.Final","kev":false}],"package":"Maven:io.netty:netty-common"}}