PT-2025-35822 · Netty +1 · Netty +1

Yawkat · Published 2025-09-03 · Updated 2025-09-24 · CVE-2025-58057

Positive Technologies · (AI Summary)

CVSS v3.1

7.5

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

**Name of the Vulnerable Software and Affected Versions**

Netty versions 4.1.124.Final and below

Netty versions 4.2.4.Final and below

**Description**

Netty is an asynchronous event-driven network application framework. Certain decompression decoders, including `BrotliDecoder`, can allocate a large number of byte buffers when provided with specially crafted input, potentially leading to a denial of service. The `decompress` function within `BrotliDecoder` repeatedly calls `pull`, decompressing data in 64KB chunks, and the resulting buffers remain reachable until an out-of-memory (OOM) error occurs.

**Recommendations**

Update to Netty version 4.1.125.Final or later.

Update to Netty version 4.2.5.Final or later.

Fix

DoS

Weakness Enumeration

CWE-409

Related Identifiers

CVE-2025-58057

GHSA-3P8M-J85Q-PGMJ

SUSE-SU-2025:03114-1

Affected Products

Debian

Netty

References · 27

• https://github.com/netty/netty/security/advisories/GHSA-3p8m-j85q-pgmj · Vendor Advisory
• https://github.com/netty/netty/commit/9d804c54ce962408ae6418255a83a13924f7145d · Patch
• https://cve.org/CVERecord?id=CVE-2025-58057 · Security Note
• https://osv.dev/vulnerability/GHSA-3p8m-j85q-pgmj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-58057 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/netty · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:03114-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-58057 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58057 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-58057 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-58057 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-58057 · Vendor Advisory
• https://github.com/netty/netty · Note
• https://twitter.com/normanmaurer/status/1963254801971429537 · Twitter Post
• https://suse.com/support/update/announcement/2025/suse-su-202503114-1 · Note