High severity · published Apr 13, 2017
CVE-2016-4970
handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite loop)
7.5
CVSS
11.3%
EPSS
No
On KEV
Description
handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite loop).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)11.3% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
Cassandra · Apache
3.11.4 · source: NVD
JD
Jboss Data Grid · Redhat
7.1 · source: NVD
JM
Jboss Middleware Text-only Advisories · Redhat
1.0 · source: NVD
NE
Netty · Netty
4.0.20 before 4.0.37; 4.1.0 before 4.1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-4970
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-4970
Release Notes
http://netty.io/news/2016/06/07/4-0-37-Final.html
Release Notes
http://netty.io/news/2016/06/07/4-1-1-Final.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-0179.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-1097.html
Third Party Advisory
http://www.securityfocus.com/bid/96540
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1343616
More from Cassandra
9.8
CVE-2016-3427
Oracle Java SE and JRockit Unspecified Vulnerability
9.8
CVE-2018-8016
The default configuration in Apache Cassandra 3.8 through 3.11.1 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute…
9.1
CVE-2021-44521
When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true…
8.8
CVE-2026-27314
Apache Cassandra: Privilege escalation via ADD IDENTITY authorization bypass
8.8
CVE-2025-26467
Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra