CVE catalog

CVE-2024-47535

netty: CVE-2024-47535

Severity: Medium · CVSS 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Published: Nov 12, 2024, 3:50:08 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.41% · Oct 25, 2026

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attempts to load a file that does not exist. If an attacker creates such a large file, the Netty application crashes. This vulnerability is fixed in 4.1.115.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	netty	sid	`1:4.1.48-16`	not affected
Debian	netty	forky	`1:4.1.48-16`	not affected
Debian	netty	trixie	`1:4.1.48-10+deb13u1`	not affected
Debian	netty	trixie-security	`1:4.1.48-10+deb13u1`	not affected
Debian	netty	bookworm	`1:4.1.48-7+deb12u2`	not affected
Debian	netty	bookworm-security	`1:4.1.48-7+deb12u2`	not affected
Suse	netty	manager server module 4.3	`4.1.44.Final-150400.3.6.3`	fixed
Suse	susemanager-sync-data	manager server module 4.3	`4.3.23-150400.3.41.3`	fixed
Suse	netty-tcnative	linux enterprise module for development tools 15 sp5	`2.0.69-150200.3.22.1`	fixed
Suse	netty-tcnative	linux enterprise module for development tools 15 sp6	`2.0.69-150200.3.22.1`	fixed
Suse	jctools	linux enterprise module for package hub 15 sp5	`4.0.5-150200.3.9.1`	fixed
Suse	netty	linux enterprise module for package hub 15 sp5	`4.1.115-150200.4.26.1`	fixed
Suse	jctools	linux enterprise module for package hub 15 sp6	`4.0.5-150200.3.9.1`	fixed
Suse	netty	linux enterprise module for package hub 15 sp6	`4.1.115-150200.4.26.1`	fixed
Opensuse	jctools	leap 15.5	`4.0.5-150200.3.9.1`	fixed
Opensuse	netty	leap 15.5	`4.1.115-150200.4.26.1`	fixed
Opensuse	netty-tcnative	leap 15.5	`2.0.69-150200.3.22.1`	fixed
Opensuse	jctools	leap 15.6	`4.0.5-150200.3.9.1`	fixed
Opensuse	netty	leap 15.6	`4.1.115-150200.4.26.1`	fixed
Opensuse	netty-tcnative	leap 15.6	`2.0.69-150200.3.22.1`	fixed
Opensuse	netty	tumbleweed	`4.1.115-1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	netty	source	sid	`Not affected`	unimportant	Not reported	Not reported
Debian	netty	source	forky	`Not affected`	unimportant	Not reported	Not reported
Debian	netty	source	trixie	`Not affected`	unimportant	Not reported	Not reported
Debian	netty	source	bookworm	`Not affected`	unimportant	Not reported	Not reported
Suse	netty	rpm	manager server module 4.3	`4.1.44.Final-150400.3.6.3`	Not reported	SUSE-SU-2025:01994-1	Not reported
Suse	susemanager-sync-data	rpm	manager server module 4.3	`4.3.23-150400.3.41.3`	Not reported	SUSE-SU-2025:01994-1	Not reported
Suse	netty-tcnative	rpm	linux enterprise module for development tools 15 sp5	`2.0.69-150200.3.22.1`	Not reported	SUSE-SU-2024:4407-1	Not reported
Suse	netty-tcnative	rpm	linux enterprise module for development tools 15 sp6	`2.0.69-150200.3.22.1`	Not reported	SUSE-SU-2024:4407-1	Not reported
Suse	jctools	rpm	linux enterprise module for package hub 15 sp5	`4.0.5-150200.3.9.1`	Not reported	SUSE-SU-2024:4407-1	Not reported
Suse	netty	rpm	linux enterprise module for package hub 15 sp5	`4.1.115-150200.4.26.1`	Not reported	SUSE-SU-2024:4407-1	Not reported
Suse	jctools	rpm	linux enterprise module for package hub 15 sp6	`4.0.5-150200.3.9.1`	Not reported	SUSE-SU-2024:4407-1	Not reported
Suse	netty	rpm	linux enterprise module for package hub 15 sp6	`4.1.115-150200.4.26.1`	Not reported	SUSE-SU-2024:4407-1	Not reported
Opensuse	jctools	rpm	leap 15.5	`4.0.5-150200.3.9.1`	Not reported	SUSE-SU-2024:4407-1	Not reported
Opensuse	netty	rpm	leap 15.5	`4.1.115-150200.4.26.1`	Not reported	SUSE-SU-2024:4407-1	Not reported
Opensuse	netty-tcnative	rpm	leap 15.5	`2.0.69-150200.3.22.1`	Not reported	SUSE-SU-2024:4407-1	Not reported
Opensuse	jctools	rpm	leap 15.6	`4.0.5-150200.3.9.1`	Not reported	SUSE-SU-2024:4407-1	Not reported
Opensuse	netty	rpm	leap 15.6	`4.1.115-150200.4.26.1`	Not reported	SUSE-SU-2024:4407-1	Not reported
Opensuse	netty-tcnative	rpm	leap 15.6	`2.0.69-150200.3.22.1`	Not reported	SUSE-SU-2024:4407-1	Not reported
Opensuse	netty	rpm	tumbleweed	`4.1.115-1.1`	Not reported	OPENSUSE-SU-2024:14549-1	Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

[netty-bom]Unknown
Source package: [netty]
Details (1)
- 4.1.136-1.1 · noarch · tumbleweed
  Unknown · Fixed: 4.1.115-1.1
  Version impact unknown
  dsa · netty · opensuse · tumbleweed
[netty-javadoc]Unknown
Source package: [netty]
Details (1)
- 4.1.136-1.1 · noarch · tumbleweed
  Unknown · Fixed: 4.1.115-1.1
  Version impact unknown
  dsa · netty · opensuse · tumbleweed
[netty-parent]Unknown
Source package: [netty]
Details (1)
- 4.1.136-1.1 · noarch · tumbleweed
  Unknown · Fixed: 4.1.115-1.1
  Version impact unknown
  dsa · netty · opensuse · tumbleweed
[netty]Fixed
Source package: [netty]
Details (1)
- 4.1.136-1.1 · x86_64 · tumbleweed
  Fixed · Fixed: 4.1.115-1.1
  dsa · netty · opensuse · tumbleweed

[Debian 12 (Bookworm)]

[libnetty-java]Not affected
Source package: [netty]
Details (4)
- 1:4.1.48-7+deb12u2 · all · bookworm
  Not affected
  dsa · netty · debian · bookworm
- 1:4.1.48-7+deb12u2 · all · bookworm
  Not affected
  dsa · netty · debian · bookworm
- 1:4.1.48-7+deb12u2 · all · bookworm-security
  Not affected
  dsa · netty · debian · bookworm
- 1:4.1.48-7+deb12u2 · all · bookworm-security
  Not affected
  dsa · netty · debian · bookworm

Observed: Oct 27, 2026, 6:49:06 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]