Vulnerability · Published Sep 3, 2025 · Assigned by GitHub_M
CVE-2025-58057Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack
Medium 6.9
In plain English
A medium-severity security flaw in netty from netty. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with specially crafted input, BrotliDecoder and certain other decompression decoders will allocate a large number of reachable byte buffers, which can lead to denial of service. BrotliDecoder.decompress has no limit in how often it calls pull, decompressing data 64K bytes at a time. The buffers are saved in the output list, and remain reachable until OOM is hit. This is fixed in versions 4.1.125.Final of netty-codec and 4.2.5.Final of netty-codec-compression.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | netty | 1:4.1.48-7+deb12u2 | DEBIAN-CVE-2025-58057 |
| Debian:12 | netty | 1:4.1.48-7+deb12u2 | DSA-6160-1 |
| Debian:13 | netty | 1:4.1.48-10+deb13u1 | DSA-6160-1 |
| Debian:13 | netty | 1:4.1.48-10+deb13u1 | DEBIAN-CVE-2025-58057 |
| Debian:14 | netty | 1:4.1.48-12 | DEBIAN-CVE-2025-58057 |
| Maven | io.netty:netty-codec | 4.1.125.Final | GHSA-3p8m-j85q-pgmj |
| Maven | io.netty:netty-codec-compression | 4.2.5.Final | GHSA-3p8m-j85q-pgmj |
| Ubuntu:22.04:LTS | netty | 1:4.1.48-4+deb11u2ubuntu0.1 | UBUNTU-CVE-2025-58057 |
| Ubuntu:24.04:LTS | netty | 1:4.1.48-9ubuntu0.1 | UBUNTU-CVE-2025-58057 |
| Ubuntu:25.10 | netty | 1:4.1.48-10ubuntu0.25.10.2 | UBUNTU-CVE-2025-58057 |
Affected products (as reported)
Weakness: CWE-409 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
References
- https://github.com/netty/netty/security/advisories/GHSA-3p8m-j85q-pgmj x_refsource_CONFIRM
- https://github.com/netty/netty/commit/9d804c54ce962408ae6418255a83a13924f7145d x_refsource_MISC