PT-2025-35821 · Netty+6 · Netty+6
Jeppw
·
Published
2025-09-03
·
Updated
2026-05-18
·
CVE-2025-58056
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
Netty versions 4.1.124.Final
Netty versions 4.2.0.Alpha3 through 4.2.4.Final
Description
Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients. Netty incorrectly accepts standalone newline characters (LF) as a chunk-size line terminator, regardless of a preceding carriage return (CR), instead of requiring CRLF per HTTP/1.1 standards. When combined with reverse proxies that parse LF differently, attackers can craft requests that the proxy sees as one request but Netty processes as two, enabling request smuggling attacks.
Recommendations
Netty version 4.1.125.Final
Netty version 4.2.5.Final
Exploit
Fix
DoS
HTTP Request/Response Smuggling
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Debian
Linuxmint
Netty
Red Os
Suse
Ubuntu