Unscored severity · published Jul 31, 2014
CVE-2014-3488
The SslHandler in Netty before 3.9.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted SSLv2Hello message
–
CVSS
4.2%
EPSS
No
On KEV
Description
The SslHandler in Netty before 3.9.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted SSLv2Hello message.
Exploitation
Is it being used?
Exploit prediction (EPSS)4.2% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
Netty · Netty
through 3.9.1.1; 3.6.0; 3.6.1; 3.6.2; 3.6.3; 3.6.4; +9 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-3488
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-3488
Vendor Advisory
http://netty.io/news/2014/06/11/3-9-2-Final.html
secunia.com
http://secunia.com/advisories/59196
github.com
https://github.com/netty/netty/commit/2fa9400a59d0563a66908aba55c41e7285a04994
Exploit
https://github.com/netty/netty/issues/2562
lists.debian.org
https://lists.debian.org/debian-lts-announce/2020/02/msg00018.html
More from Netty
7.5
CVE-2023-44487
HTTP/2 Rapid Reset Attack Vulnerability
10.0
CVE-2026-47691
Netty has Insufficient Bailiwick Validation for NS Records
10.0
CVE-2026-45674
Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records
9.8
CVE-2026-56817
Netty: XML External Entity (XXE) injection via unconfigured XML factory when DTD and entity processing are enabled
9.8
CVE-2026-42581
Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization