IDP 5.1.6 CVE-2025-24970(

[Dan McLaughlin]

Heads up, IDP 5.1.6 is being flagged for a new CVE because of old
versions of Netty.

[ERROR] idp-war-5.1.6.war: netty-codec-4.1.108.Final.jar
(pkg:maven/io.netty/netty-codec at 4.1.108.Final,
cpe:2.3:a:netty:netty:4.1.108:*:*:*:*:*:*:*): CVE-2025-24970(7.5)
[ERROR] idp-war-5.1.6.war: netty-transport-4.1.108.Final.jar
(pkg:maven/io.netty/netty-transport at 4.1.108.Final,
cpe:2.3:a:netty:netty:4.1.108:*:*:*:*:*:*:*): CVE-2025-24970(7.5)

We've been running with IDP 5.1.6 with Netty 2.4.5 all week and
haven't seen any issues.

--

Thanks,

Dan