CVE-2025-58057 — Improper Handling of Highly Compressed Data (Data Amplification) in Netty

CWE-409 — Improper Handling of Highly Compressed Data (Data Amplification)10 documents7 sources
Severity
6.9MEDIUMNVD
OSV2.9
EPSS
0.1%
top 80.63%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
NettyDebian Netty
Timeline
PublishedSep 4
Latest updateJan 15

Description

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with specially crafted input, BrotliDecoder and certain other decompression decoders will allocate a large number of reachable byte buffers, which can lead to denial of service. BrotliDecoder.decompress has no limit in how oft…

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Affected Packages5 packages

▶NVDnetty/netty4.2.0 — 4.2.5+1
▶debiandebian/netty< netty 1:4.1.48-7+deb12u2 (bookworm)
▶Debiannetty/netty< 1:4.1.48-4+deb11u3+3
▶Ubuntunetty/netty< 1:4.1.48-4+deb11u2ubuntu0.1+5
▶CVEListV5netty/netty4.1.124.Final, < 4.1.125.Final

Patches

Patch: github.com ↗

🔴Vulnerability Details

4
OSV
netty vulnerabilities↗2025-12-09
▶
OSV
CVE-2025-58057: Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients↗2025-09-04
▶
OSV
Netty's decoders vulnerable to DoS via zip bomb style attack↗2025-09-03
▶
GHSA
Netty's decoders vulnerable to DoS via zip bomb style attack↗2025-09-03
▶

📋Vendor Advisories

5
Oracle
Oracle Oracle Communications Risk Matrix: Security (Netty) — CVE-2025-58057↗2026-01-15
▶
Ubuntu
Netty vulnerabilities↗2025-12-09
▶
Oracle
Oracle Oracle Communications Risk Matrix: Configuration (Netty) — CVE-2025-58057↗2025-10-15
▶
Red Hat
netty-codec: netty-codec-compression: Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack↗2025-09-03
▶
Debian
CVE-2025-58057: netty - Netty is an asynchronous event-driven network application framework for rapid de...↗2025
▶