WaratekVRT Sign in

High Oracle Communications Applications Security (Netty) CVEs

3 CVEs, 1 exploited

Reset
More filters (1)
Columns
Oracle product: Oracle Communications Applications / Security (Netty)✕
Overview 3 matches · 0 protected · 1 exploited · 1 CISA KEV · 1 public PoC · 1 EPSS ≥ 0.5
3matches 0protected0.0% 1exploited33.3% 1CISA KEV33.3% 1public PoC33.3% 1EPSS ≥ 0.533.3%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 1 33.3% No exploit published 2 66.7%
Critical 0 0.0% High 3 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 3 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 33.3% Working exploit published 0 0.0% Proof of concept only 1 33.3% Forecast only 0 0.0% No public exploit 1 33.3%
split by peak 1 / month
No exploit published: 2Mitigation candidate: 1 High: 3 not blocked: 3 No public exploit: 1Proof of concept only: 1Exploited: 1
Oct 231 Mitigation candidate1 High1 not blocked1 Exploited1 Nov 230 Dec 230 Jan 240 Feb 240 Mar 240 Apr 240 May 240 Jun 241 No exploit published1 High1 not blocked1 No public exploit1 Jul 240 Aug 240 Sep 240 Oct 240 Nov 240 Dec 240 Jan 250 Feb 251 No exploit published1 High1 not blocked1 Proof of concept only1
Oct 23Dec 23Feb 24Apr 24Jun 24Aug 24Oct 24Dec 24Feb 25
3 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-24970 High 2025-02-10 No exploit published Proof of concept only Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which can lead to a native crash. Version 4.1.118.Final contains a patch. As workaround its possible to either disable the usage of the native SSLEngine or change the code manually.
CVE-2024-6162 High 2024-06-20 No exploit published No public exploit A vulnerability was found in Undertow, where URL-encoded request paths can be mishandled during concurrent requests on the AJP listener. This issue arises because the same buffer is used to decode the paths for multiple requests simultaneously, leading to incorrect path information being processed. As a result, the server may attempt to access the wrong path, causing errors such as "404 Not Found" or other application failures. This flaw can potentially lead to a denial of service, as legitimate resources become inaccessible due to the path mix-up.
CVE-2023-44487 High 2023-10-10 Mitigation candidate Exploited The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.