CVE Feed

    Dashboard / CVE / CVE-2016-4970

    CVE-2016-4970

    handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite loop).

    Published:Jun 7, 2016
    Last Modified:Apr 20, 2025
    EPS:Apr 13, 2017
    EPSS Score:0.0823
    CVSS Score:7.5

    Affected Products

    Vendor
    Apache
    Product
    Cassandra
    Vendor
    Netty
    Product
    Netty
    Vendor
    Redhat
    Product
    Jboss Amq
    Vendor
    Redhat
    Product
    Jboss Data Grid
    Vendor
    Redhat
    Product
    Jboss Fuse
    Vendor
    Redhat
    Product
    Jboss Middleware Text-only Advisories

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-32588 (CVSS 6.5) — Authenticated DoS over CQL in Apache Cassandra 4.0, 4.1, 5.0 allows authenticated user to raise query latencie…
    CVE-2026-27315 (CVSS 5.5) — Sensitive Information Leak in cqlsh in Apache Cassandra 4.0 allows access to sensitive information, like passw…
    CVE-2026-27314 (CVSS 8.8) — Privilege escalation in Apache Cassandra 5.0 on an mTLS environment using MutualTlsAuthenticator allows a user…
    CVE-2025-26467 (CVSS 8.8) — Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL…
    CVE-2024-27137 (CVSS 5.3) — In Apache Cassandra it is possible for a local attacker without access to the Apache Cassandra process or con…
    CVE-2025-24860 (CVSS 5.4) — Incorrect Authorization vulnerability in Apache Cassandra allowing users to access a datacenter or IP/CIDR gro…
    CVE-2025-23015 (CVSS 8.8) — Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL…
    CVE-2023-30601 (CVSS 7.8) — Privilege escalation when enabling FQL/Audit logs allows user with JMX access to run arbitrary commands as the…
    CVE-2021-44521 (CVSS 9.1) — When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scr…
    CVE-2020-17516 (CVSS 7.5) — Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using …

    References

    http://netty.io/news/2016/06/07/4-0-37-Final.html
    http://netty.io/news/2016/06/07/4-1-1-Final.html
    http://rhn.redhat.com/errata/RHSA-2017-0179.html
    http://rhn.redhat.com/errata/RHSA-2017-1097.html
    http://www.securityfocus.com/bid/96540
    https://bugzilla.redhat.com/show_bug.cgi?id=1343616
    https://github.com/netty/netty/pull/5364
    https://lists.apache.org/thread.html/afaa5860e3a6d327eb96c3d82cbd2f5996de815a16854ed1ad310144%40%3Ccommits.cassandra.apache.org%3E
    https://wiki.opendaylight.org/view/Security_Advisories
    http://netty.io/news/2016/06/07/4-0-37-Final.html
    http://netty.io/news/2016/06/07/4-1-1-Final.html
    http://rhn.redhat.com/errata/RHSA-2017-0179.html
    http://rhn.redhat.com/errata/RHSA-2017-1097.html
    http://www.securityfocus.com/bid/96540
    https://bugzilla.redhat.com/show_bug.cgi?id=1343616
    https://github.com/netty/netty/pull/5364
    https://lists.apache.org/thread.html/afaa5860e3a6d327eb96c3d82cbd2f5996de815a16854ed1ad310144%40%3Ccommits.cassandra.apache.org%3E
    https://wiki.opendaylight.org/view/Security_Advisories

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High