The SslHandler in Netty before 3.9.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted SSLv2Hello message.

Affected Packages

Maven io.netty:netty-handler

Affected versions: 0 (fixed in 3.9.2)

Related CVEs

CVE-2014-3488

Key Information

GHSA ID

GHSA-9959-6p3m-wxpc

Published

June 30, 2020 9:01 PM

Last Modified

September 22, 2021 6:44 PM

CVSS Score

5.0 /10

Primary Ecosystem

Maven

Primary Package

io.netty:netty-handler

GitHub Reviewed

✓ Yes

Dataset

Last updated: September 3, 2025 6:33 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.