← Vulnerability feed

Vulnerability record · CVE-2016-4970 · published 13 April 2017

CVE-2016-4970: Netty vulnerability

Netty · Netty

handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite loop).

7.5 CVSS 3.1 High EPSS 11% · top 4.2% CWE-835 · CWE-835
7.5CVSS 3.1 base score, v2 7.8
11%EPSS exploitation probability, 30 days
NoNot in CISA KEV
4Affected product versions listed by NVD
18References
17 Jun 2026Last modified by NVD

Description

handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite loop).

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://netty.io/news/2016/06/07/4-0-37-Final.html Release NotesVendor Advisory
http://netty.io/news/2016/06/07/4-1-1-Final.html Release NotesVendor Advisory
http://rhn.redhat.com/errata/RHSA-2017-0179.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-1097.html Third Party Advisory
http://www.securityfocus.com/bid/96540 Third Party AdvisoryVDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1343616 Issue TrackingThird Party AdvisoryVDB Entry
https://github.com/netty/netty/pull/5364 PatchThird Party Advisory
https://lists.apache.org/thread.html/afaa5860e3a6d327eb96c3d82cbd2f5996de815a16854ed1ad310144%40%3Ccommits.cassandra.apa
https://wiki.opendaylight.org/view/Security_Advisories Third Party Advisory
http://netty.io/news/2016/06/07/4-0-37-Final.html Release NotesVendor Advisory
http://netty.io/news/2016/06/07/4-1-1-Final.html Release NotesVendor Advisory
http://rhn.redhat.com/errata/RHSA-2017-0179.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-1097.html Third Party Advisory
http://www.securityfocus.com/bid/96540 Third Party AdvisoryVDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1343616 Issue TrackingThird Party AdvisoryVDB Entry
https://github.com/netty/netty/pull/5364 PatchThird Party Advisory
https://lists.apache.org/thread.html/afaa5860e3a6d327eb96c3d82cbd2f5996de815a16854ed1ad310144%40%3Ccommits.cassandra.apa
https://wiki.opendaylight.org/view/Security_Advisories Third Party Advisory

Track CVE-2016-4970 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2016-4437Apache Shiro hardcoded remember-me cipher key enables code executionApache Shiro before 1.2.5 uses a default cipher key for the "remember me" feature when no key is configured, allowing attackers to forge or decrypt r…KEVEPSS 93%analysed9.8CVE-2016-3427Oracle Java SE JMX Improper Access Control VulnerabilityCVE-2016-3427 is an unspecified vulnerability in Oracle Java SE 6u113, 7u99, 8u77, Java SE Embedded 8u77, and JRockit R28.3.9, reached through vector…KEVEPSS 92%analysed7.5CVE-2023-44487HTTP/2 Rapid Reset stream cancellation denial of serviceThe HTTP/2 protocol permits a client to cancel many streams quickly, and the server's handling of those resets consumes disproportionate resources. T…KEVEPSS 100%analysed10.0CVE-2026-47691Netty insufficient verification of data authenticity vulnerabilityNetty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's `…EPSS 0.36%10.0CVE-2026-45674Netty insufficient verification of data authenticity vulnerabilityNetty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's D…EPSS 0.36%9.8CVE-2026-42581Netty http request smuggling vulnerabilityNetty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting…EPSS 0.68%9.8CVE-2019-14892Fasterxml jackson-databind information exposure vulnerabilityA flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a mal…EPSS 5.6%9.8CVE-2019-10158Infinispan vulnerabilityA flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session inte…EPSS 2.0%

Source: NIST National Vulnerability Database (record CVE-2016-4970), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.