CVE-2025-25193

Netty, an asynchronous, event-driven network application framework, has a vulnerability in versions up to and including 4.1.118.Final. An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attempts to load a file that does not exist. If an attacker creates such a large file, the Netty application crash. A similar issue was previously reported as CVE-2024-47535. This issue was fixed, but the fix was incomplete in that null-bytes were not counted against the input limit. Commit d1fbda62d3a47835d3fb35db8bd42ecc205a5386 contains an updated fix.

• CWE-400

• https://github.com/netty/netty/commit/d1fbda62d3a47835d3fb35db8bd42ecc205a5386Patch, Third Party Advisory
• https://github.com/netty/netty/security/advisories/GHSA-389x-839f-4rhxThird Party Advisory
• https://security.netapp.com/advisory/ntap-20250221-0006/Third Party Advisory
• https://github.com/netty/netty/security/advisories/GHSA-389x-839f-4rhxThird Party Advisory

Published

Feb 10, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-25188Hickory DNS is a Rust based DNS client, server, and resolver…5.7
• CVE-2025-25189The ZOO-Project is an open source processing platform. A ref…5.5
• CVE-2025-2519The Sreamit theme for WordPress is vulnerable to arbitrary f…6.5
• CVE-2025-25190The ZOO-Project is an open source processing platform. The Z…5.5
• CVE-2025-25191Group-Office is an enterprise CRM and groupware tool. This S…5.4
• CVE-2025-25192GLPI is a free asset and IT management software package. Pri…6.5
• CVE-2025-25194Lemmy, a link aggregator and forum for the fediverse, is vul…4
• CVE-2025-25195Zulip is an open source team chat application. A weekly cron…4.3
• CVE-2025-25196OpenFGA is a high-performance and flexible authorization/per…9.8
• CVE-2025-25197Silverstripe Elemental extends a page type to swap the conte…5.4
• CVE-2025-25198mailcow: dockerized is an open source groupware/email suite …8.8
• CVE-2025-25199go-crypto-winnative Go crypto backend for Windows using Cryp…7.5