Read the docs
TI-2014-02815 Aliases CVE-2014-3488GHSA-9959-6p3m-wxpc

The SslHandler in Netty before 3.9.2 allows remote attackers to cause a denial of service…

Priority LOW 30CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-119 and the CVSS impact.

Summary

The SslHandler in Netty before 3.9.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted SSLv2Hello message.

Why it matters now

EPSS 0.04222 91st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed io.netty:netty-handler (Maven): 3.9.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—io.netty:netty-handler (Maven)before 3.9.23.9.2Patch availableGHSA-9959-6p3m-wxpc
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • io.netty:netty-handler (Maven) Vendor— Affected before 3.9.2 Fixed in 3.9.2 Patch available GHSA-9959-6p3m-wxpc

CPE configurations NVD · 15

CPEVersionsRoleVendor
cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*up to 3.9.1.1Vulnerablenetty
cpe:2.3:a:netty:netty:3.6.0:*:*:*:*:*:*:*3.6.0Vulnerablenetty
cpe:2.3:a:netty:netty:3.6.1:*:*:*:*:*:*:*3.6.1Vulnerablenetty
cpe:2.3:a:netty:netty:3.6.2:*:*:*:*:*:*:*3.6.2Vulnerablenetty
cpe:2.3:a:netty:netty:3.6.3:*:*:*:*:*:*:*3.6.3Vulnerablenetty
cpe:2.3:a:netty:netty:3.6.4:*:*:*:*:*:*:*3.6.4Vulnerablenetty
cpe:2.3:a:netty:netty:3.6.5:*:*:*:*:*:*:*3.6.5Vulnerablenetty
cpe:2.3:a:netty:netty:3.6.6:*:*:*:*:*:*:*3.6.6Vulnerablenetty
cpe:2.3:a:netty:netty:3.6.7:*:*:*:*:*:*:*3.6.7Vulnerablenetty
cpe:2.3:a:netty:netty:3.6.8:*:*:*:*:*:*:*3.6.8Vulnerablenetty
  • cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* Versions up to 3.9.1.1 Vulnerable ·netty
  • cpe:2.3:a:netty:netty:3.6.0:*:*:*:*:*:*:* Versions 3.6.0 Vulnerable ·netty
  • cpe:2.3:a:netty:netty:3.6.1:*:*:*:*:*:*:* Versions 3.6.1 Vulnerable ·netty
  • cpe:2.3:a:netty:netty:3.6.2:*:*:*:*:*:*:* Versions 3.6.2 Vulnerable ·netty
  • cpe:2.3:a:netty:netty:3.6.3:*:*:*:*:*:*:* Versions 3.6.3 Vulnerable ·netty
  • cpe:2.3:a:netty:netty:3.6.4:*:*:*:*:*:*:* Versions 3.6.4 Vulnerable ·netty
  • cpe:2.3:a:netty:netty:3.6.5:*:*:*:*:*:*:* Versions 3.6.5 Vulnerable ·netty
  • cpe:2.3:a:netty:netty:3.6.6:*:*:*:*:*:*:* Versions 3.6.6 Vulnerable ·netty
  • cpe:2.3:a:netty:netty:3.6.7:*:*:*:*:*:*:* Versions 3.6.7 Vulnerable ·netty
  • cpe:2.3:a:netty:netty:3.6.8:*:*:*:*:*:*:* Versions 3.6.8 Vulnerable ·netty
Show 5 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:netty:netty:3.7.0:*:*:*:*:*:*:*3.7.0Vulnerablenetty
cpe:2.3:a:netty:netty:3.8.0:*:*:*:*:*:*:*3.8.0Vulnerablenetty
cpe:2.3:a:netty:netty:3.8.1:*:*:*:*:*:*:*3.8.1Vulnerablenetty
cpe:2.3:a:netty:netty:3.9.0:*:*:*:*:*:*:*3.9.0Vulnerablenetty
cpe:2.3:a:netty:netty:3.9.1:*:*:*:*:*:*:*3.9.1Vulnerablenetty
  • cpe:2.3:a:netty:netty:3.7.0:*:*:*:*:*:*:* Versions 3.7.0 Vulnerable ·netty
  • cpe:2.3:a:netty:netty:3.8.0:*:*:*:*:*:*:* Versions 3.8.0 Vulnerable ·netty
  • cpe:2.3:a:netty:netty:3.8.1:*:*:*:*:*:*:* Versions 3.8.1 Vulnerable ·netty
  • cpe:2.3:a:netty:netty:3.9.0:*:*:*:*:*:*:* Versions 3.9.0 Vulnerable ·netty
  • cpe:2.3:a:netty:netty:3.9.1:*:*:*:*:*:*:* Versions 3.9.1 Vulnerable ·netty

Remediation

  • Fix · GHSA-9959-6p3m-wxpc io.netty:netty-handler (Maven) Fixed in 3.9.2 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 10 products
  • Red Hat BPM Suite 6
  • Red Hat JBoss BRMS 6
  • Red Hat JBoss Enterprise Application Platform 5
  • Red Hat JBoss Enterprise Application Platform 6
  • Red Hat JBoss Fuse Service Works 6
  • Red Hat JBoss Portal 5
  • Red Hat JBoss Portal 6
  • Red Hat Satellite 6
  • Red Hat Software Collections
  • Red Hat Subscription Asset Manager

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-3488
  2. 2026-10-03 Alias added: GHSA-9959-6p3m-wxpc

References

Exploit 1

Advisory 2

Other 3

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-30861 Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization CVSS 3.1CRITICAL 9.8
  • TI-2026-30864 Netty: HttpClientCodec response desynchronization CVSS 3.1CRITICAL 9.1
  • TI-2026-30859 Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) CVSS 3.1CRITICAL 9.1
  • TI-2026-40973 Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks CVSS 3.1CRITICAL 9.1
  • TI-2026-40972 Uncontrolled resource consumption in netty CVSS 3.1HIGH 7.5
See all 92 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences