Netty - Security Vulnerability: CVE-2025-24970

[mesutacar0]

Hello,

There was a transitive security vulnerability for snowflake-jdbc(3.22.0) causing by io.netty, and the recommendation was to upgrade netty to 4.1.118.Final or higher versions.

I can see in parent.pom of 3.23.0; netty has been upgraded to 4.1.118.Final, but snowflake-jdbc 3.23.00 still seems to have same vulnerabiltiy(CVE-2025-24970).

any idea what might be the cause?

Thanks.

[sfc-gh-dszmolka]

hi - i'm wondering what is this tool or where you're seeing snowflake-jdbc 3.23.0 being shown as susceptible to CVE-2025-24970 ?

[mesutacar0]

hi,

sorry for late reply.
that was an internal security scan and apparently a false alarm.

thanks.

[mesutacar0]

closing the issue.