# CVE-2025-25193: netty: This update for netty, netty-tcnative fixes the following issues:  - CVE-2025-24970: incorrect validation of packets...

CVE-2025-25193 is fixed in 2 products on 1 platform, first by SUSE-SU-2025:0590-1, released February 19, 2025. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2025-25193
- Priority: Routine
- CVSS: n/a
- EPSS: 0.0039
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Feb 19, 2025

## Description

This update for netty, netty-tcnative fixes the following issues:  - CVE-2025-24970: incorrect validation of packets by SslHandler can lead to a native crash. (bsc#1237037) - CVE-2025-25193: unsafe reading of environment files can lead to an application crash. (bsc#1237038)  Update to netty version 4.1.118 and netty-tcnative version 2.0.70 Final.      Other fixes:  - Fix recycling in CodecOutputList.     - StreamBufferingEncoder: do not send header frame with priority by default. - Notify event loop termination future of unexpected exceptions. - Fix AccessControlException in GlobalEventExecutor. - AdaptivePoolingAllocator: round chunk sizes up and reduce chunk release frequency. - Support BouncyCastle FIPS for reading PEM files. - Dns: correctly encode DnsPtrRecord. - Provide Brotli settings without com.aayushatharva.brotli4j dependency. - Make DefaultResourceLeak more resilient against OOM. - OpenSslSession: add support to defensively check for peer certs. - SslHandler: ensure buffers are never leaked when wrap(...) produces SSLException. - Correcly handle comments appended to nameserver declarations. - PcapWriteHandler: apply fixes so that the handler can append to an existing PCAP file when writing the global header. - PcapWriteHandler: allow output of PCAP files larger than 2GB. - Fix bugs in BoundedInputStream. - Fix HTTP header validation bug. - AdaptivePoolingAllocator: fix possible race condition in method offerToQueue(...). - AdaptivePoolingAllocator: make sure the sentinel object Magazine.MAGAZINE_FREED not be replaced. - Only try to use Zstd and Brotli if the native libs can be loaded. - Bump BlockHound version to 1.0.10.RELEASE. - Add details to TooLongFrameException message. - AdaptivePoolingAllocator: correctly reuse chunks. - AdaptivePoolingAllocator: don't fail when we run on a host with 1 core. - AdaptivePoolingAllocator: correctly re-use central queue chunks and avoid OOM issue. - Fix several memory management (leaks and missing checks) issues.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | netty opensuse-leap 15.6 | 4.1.118-150200.4.29.2 | [SUSE-SU-2025:0590-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0590-1.md) | Feb 19, 2025 |
| Linux | netty sles 15.6 | 4.1.118-150200.4.29.2 | [SUSE-SU-2025:0590-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0590-1.md) | Feb 19, 2025 |
| Linux | netty-tcnative opensuse-leap 15.6 | 2.0.70-150200.3.25.1 | [SUSE-SU-2025:0590-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0590-1.md) | Feb 19, 2025 |
| Linux | netty-tcnative sles 15.6 | 2.0.70-150200.3.25.1 | [SUSE-SU-2025:0590-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-0590-1.md) | Feb 19, 2025 |

---

Data as of 2026-11-10T13:56:55Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.