CVE-2025-58056
published 2025-09-03CVE-2025-58056: Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients. In versions…
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EPSS
0.63%
46.5th percentile
Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients. In versions 4.1.124.Final, and 4.2.0.Alpha3 through 4.2.4.Final, Netty incorrectly accepts standalone newline characters (LF) as a chunk-size line terminator, regardless of a preceding carriage return (CR), instead of requiring CRLF per HTTP/1.1 standards. When combined with reverse proxies that parse LF differently (treating it as part of the chunk extension), attackers can craft requests that the proxy sees as one request but Netty processes as two, enabling request smuggling attacks. This is fixed in versions 4.1.125.Final and 4.2.5.Final.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | netty | < netty 1:4.1.48-7+deb12u2 (bookworm) | netty 1:4.1.48-7+deb12u2 (bookworm) |
| netty | netty | < 4.1.125 | 4.1.125 |
| netty | netty | <= 4.1.124.Final, < 4.1.125.Final | — |
| netty | netty | — | — |
| netty | netty | >= 0 < 1:4.1.48-4+deb11u3 | 1:4.1.48-4+deb11u3 |
| netty | netty | >= 0 < 1:4.1.48-7+deb12u2 | 1:4.1.48-7+deb12u2 |
| netty | netty | >= 0 < 1:4.1.48-10+deb13u1 | 1:4.1.48-10+deb13u1 |
| netty | netty | >= 0 < 1:4.1.48-13 | 1:4.1.48-13 |
| netty | netty | >= 0 < 1:4.1.48-4+deb11u2ubuntu0.1 | 1:4.1.48-4+deb11u2ubuntu0.1 |
| netty | netty | >= 0 < 1:4.1.48-9ubuntu0.1 | 1:4.1.48-9ubuntu0.1 |
| netty | netty | >= 0 < 1:4.1.48-10ubuntu0.25.10.2 | 1:4.1.48-10ubuntu0.25.10.2 |
| netty | netty | >= 0 < 1:4.0.34-1ubuntu0.1~esm3 | 1:4.0.34-1ubuntu0.1~esm3 |
| netty | netty | >= 0 < 1:4.1.7-4ubuntu0.1+esm5 | 1:4.1.7-4ubuntu0.1+esm5 |
| netty | netty | >= 0 < 1:4.1.45-1ubuntu0.1~esm4 | 1:4.1.45-1ubuntu0.1~esm4 |
| netty | netty | >= 4.2.0 < 4.2.5 | 4.2.5 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv4.02.9LOWCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv2.9LOW
vendor_ubuntu7.5HIGH
vendor_debian2.9LOW
vendor_redhat2.9LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
netty vulnerabilities
osv·2025-12-09·CVSS 2.9
CVE-2025-58056 [LOW] netty vulnerabilities
netty vulnerabilities
Jeppe Bonde Weikop discovered that Netty incorrectly parsed HTTP
messages. When Netty is used with certain reverse proxies, a
remote attacker could possibly use this issue to perform HTTP request
smuggling attacks. (CVE-2025-58056)
Jonas Konrad discovered that Netty did not properly manage memory when
decoding compressed data. A remote attacker could possibly use this
issue to cause Netty to consume excessive memory, resulting in a denial
of service. This issue was only addressed in Ubuntu 18.04 LTS, Ubuntu
20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.04, and
Ubuntu 25.10. (CVE-2025-58057)
GHSA
Netty vulnerable to request smuggling due to incorrect parsing of chunk extensions
ghsa·2025-09-04
CVE-2025-58056 [LOW] CWE-444 Netty vulnerable to request smuggling due to incorrect parsing of chunk extensions
Netty vulnerable to request smuggling due to incorrect parsing of chunk extensions
## Summary
A flaw in netty's parsing of chunk extensions in HTTP/1.1 messages with chunked encoding can lead to request smuggling issues with some reverse proxies.
## Details
When encountering a newline character (LF) while parsing a chunk extension, netty interprets the newline as the end of the chunk-size line regardless of whether a preceding carriage return (CR) was found. This is in violation of the HTTP 1.1 standard which specifies that the chunk extension is terminated by a CRLF sequence (see the [RFC](https://datatracker.ietf.org/doc/html/rfc9112#name-chunked-transfer-coding)).
This is by itself harmless, but consider an intermediary with a similar parsing flaw: while parsing a chunk extension, th
OSV
Netty vulnerable to request smuggling due to incorrect parsing of chunk extensions
osv·2025-09-04
CVE-2025-58056 [LOW] Netty vulnerable to request smuggling due to incorrect parsing of chunk extensions
Netty vulnerable to request smuggling due to incorrect parsing of chunk extensions
## Summary
A flaw in netty's parsing of chunk extensions in HTTP/1.1 messages with chunked encoding can lead to request smuggling issues with some reverse proxies.
## Details
When encountering a newline character (LF) while parsing a chunk extension, netty interprets the newline as the end of the chunk-size line regardless of whether a preceding carriage return (CR) was found. This is in violation of the HTTP 1.1 standard which specifies that the chunk extension is terminated by a CRLF sequence (see the [RFC](https://datatracker.ietf.org/doc/html/rfc9112#name-chunked-transfer-coding)).
This is by itself harmless, but consider an intermediary with a similar parsing flaw: while parsing a chunk extension, th
OSV
CVE-2025-58056: Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients
osv·2025-09-03·CVSS 2.9
CVE-2025-58056 [LOW] CVE-2025-58056: Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients
Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients. In versions 4.1.124.Final, and 4.2.0.Alpha3 through 4.2.4.Final, Netty incorrectly accepts standalone newline characters (LF) as a chunk-size line terminator, regardless of a preceding carriage return (CR), instead of requiring CRLF per HTTP/1.1 standards. When combined with reverse proxies that parse LF differently (treating it as part of the chunk extension), attackers can craft requests that the proxy sees as one request but Netty processes as two, enabling request smuggling attacks. This is fixed in versions 4.1.125.Final and 4.2.5.Final.
Ubuntu
Netty vulnerabilities
vendor_ubuntu·2025-12-09·CVSS 7.5
CVE-2025-58056 [HIGH] Netty vulnerabilities
Title: Netty vulnerabilities
Summary: Several security issues were fixed in Netty.
Jeppe Bonde Weikop discovered that Netty incorrectly parsed HTTP
messages. When Netty is used with certain reverse proxies, a
remote attacker could possibly use this issue to perform HTTP request
smuggling attacks. (CVE-2025-58056)
Jonas Konrad discovered that Netty did not properly manage memory when
decoding compressed data. A remote attacker could possibly use this
issue to cause Netty to consume excessive memory, resulting in a denial
of service. This issue was only addressed in Ubuntu 18.04 LTS, Ubuntu
20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.04, and
Ubuntu 25.10. (CVE-2025-58057)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
netty-codec-http: Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions
vendor_redhat·2025-09-03·CVSS 2.9
CVE-2025-58056 [LOW] CWE-444 netty-codec-http: Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions
netty-codec-http: Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions
Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients. In versions 4.1.124.Final, and 4.2.0.Alpha3 through 4.2.4.Final, Netty incorrectly accepts standalone newline characters (LF) as a chunk-size line terminator, regardless of a preceding carriage return (CR), instead of requiring CRLF per HTTP/1.1 standards. When combined with reverse proxies that parse LF differently (treating it as part of the chunk extension), attackers can craft requests that the proxy sees as one request but Netty processes as two, enabling request smuggling attacks. This is fixed in versions 4.1.125.Final and 4.2.5.Final.
Debian
CVE-2025-58056: netty - Netty is an asynchronous event-driven network application framework for developm...
vendor_debian·2025·CVSS 2.9
CVE-2025-58056 [LOW] CVE-2025-58056: netty - Netty is an asynchronous event-driven network application framework for developm...
Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients. In versions 4.1.124.Final, and 4.2.0.Alpha3 through 4.2.4.Final, Netty incorrectly accepts standalone newline characters (LF) as a chunk-size line terminator, regardless of a preceding carriage return (CR), instead of requiring CRLF per HTTP/1.1 standards. When combined with reverse proxies that parse LF differently (treating it as part of the chunk extension), attackers can craft requests that the proxy sees as one request but Netty processes as two, enabling request smuggling attacks. This is fixed in versions 4.1.125.Final and 4.2.5.Final.
Scope: local
bookworm: resolved (fixed in 1:4.1.48-7+deb12u2)
bullseye: resolved (fixed in 1:4.1.48-4+de
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-58056 byte-buddy: Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions [fedora-42]
bugzilla·2025-11-13·CVSS 2.9
CVE-2025-58056 [LOW] CVE-2025-58056 byte-buddy: Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions [fedora-42]
CVE-2025-58056 byte-buddy: Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It
Bugzilla
CVE-2025-58056 netty-codec-http: Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions
bugzilla·2025-09-03·CVSS 7.5
CVE-2025-58056 [HIGH] CVE-2025-58056 netty-codec-http: Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions
CVE-2025-58056 netty-codec-http: Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions
Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients. In versions 4.1.124.Final, and 4.2.0.Alpha3 through 4.2.4.Final, Netty incorrectly accepts standalone newline characters (LF) as a chunk-size line terminator, regardless of a preceding carriage return (CR), instead of requiring CRLF per HTTP/1.1 standards. When combined with reverse proxies that parse LF differently (treating it as part of the chunk extension), attackers can craft requests that the proxy sees as one request but Netty processes as two, enabling request smuggling attacks. This is fixed in versions 4.1.125.Final a
https://datatracker.ietf.org/doc/html/rfc9112#name-chunked-transfer-codinghttps://github.com/JLLeitschuh/unCVEed/issues/1https://github.com/netty/netty/commit/edb55fd8e0a3bcbd85881e423464f585183d1284https://github.com/netty/netty/issues/15522https://github.com/netty/netty/pull/15611https://github.com/netty/netty/security/advisories/GHSA-fghv-69vj-qj49https://w4ke.info/2025/06/18/funky-chunks.html
2025-09-03
Published