CVE-2025-58057

Description

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with specially crafted input, BrotliDecoder and certain other decompression decoders will allocate a large number of reachable byte buffers, which can lead to denial of service. BrotliDecoder.decompress has no limit in how often it calls pull, decompressing data 64K bytes at a time. The buffers are saved in the output list, and remain reachable until OOM is hit. This is fixed in versions 4.1.125.Final of netty-codec and 4.2.5.Final of netty-codec-compression.

CVSS Metrics

• v4.0•MEDIUM•Score: 6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
• v4.0•MEDIUM•Score: 6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
• v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.60%• Percentile: 47%

Techniques & Countermeasures

• CWE-409•Improper Handling of Highly Compressed Data (Data Amplification)

  The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Affected Systems

• chainguard•akhq

  < 0.26.0-r3 | < 0.26.0-r4

• chainguard•apache-activemq-artemis

  < 2.42.0-r8

• chainguard•apache-activemq-artemis-compat

  < 2.42.0-r8

• chainguard•apache-hop

  < 2.16.0-r0

• chainguard•apache-hop-fips

  < 2.16.0-r0

• chainguard•apache-nifi

  < 2.5.0-r6

• chainguard•apache-nifi-compat

  < 2.5.0-r6

• chainguard•apache-nifi-toolkit

  < 2.5.0-r6

• chainguard•apache-pulsar

  < 4.0.6-r2

• chainguard•apache-pulsar-compat

  < 4.0.6-r2

• chainguard•apicurio-registry

  < 3.0.13-r1

• chainguard•apicurio-registry-nginx-config

  < 3.0.13-r1

• chainguard•apicurio-registry-ui

  < 3.0.13-r1

• chainguard•camunda-zeebe-8.6

  < 8.6.27-r1

• chainguard•camunda-zeebe-8.6-compat

  < 8.6.27-r1

• chainguard•camunda-zeebe-8.7

  < 8.7.12-r2

• chainguard•camunda-zeebe-8.7-compat

  < 8.7.12-r2

• chainguard•cassandra-5.0

  < 5.0.5-r5

• chainguard•cassandra-5.0-compat

  < 5.0.5-r5

• chainguard•cassandra-5.0-entrypoint-compat

  < 5.0.5-r5

• chainguard•cassandra-5.0-iamguarded-compat

  < 5.0.5-r5

• chainguard•cassandra-fips-5.0

  < 5.0.3-r10

• chainguard•cassandra-fips-5.0-compat

  < 5.0.3-r10

• chainguard•cassandra-reaper

  < 3.8.0-r11

• chainguard•celeborn-0.5

  all | < 0.5.4-r26

• chainguard•celeborn-0.6

  < 0.6.3-r7

• chainguard•cloudwatch-exporter

  < 0.16.0-r7

• chainguard•commercial-elasticsearch-8.17

  all

• chainguard•cqlsh-5.0

  < 5.0.5-r5

• chainguard•cqlsh-fips-5.0

  < 5.0.3-r10

• chainguard•docker-selenium

  < 4.35.0.20250828-r0

• chainguard•docker-selenium-base

  < 4.35.0.20250828-r0

• chainguard•docker-selenium-compat

  < 4.35.0.20250828-r0

• chainguard•docker-selenium-distributor

  < 4.35.0.20250828-r0

• chainguard•docker-selenium-event-bus

  < 4.35.0.20250828-r0

• chainguard•docker-selenium-hub

  < 4.35.0.20250828-r0

• chainguard•docker-selenium-node-base

  < 4.35.0.20250828-r0

• chainguard•docker-selenium-node-chromium

  < 4.35.0.20250828-r0

• chainguard•docker-selenium-node-docker

  < 4.35.0.20250828-r0

• chainguard•docker-selenium-node-firefox

  < 4.35.0.20250828-r0

• chainguard•docker-selenium-router

  < 4.35.0.20250828-r0

• chainguard•docker-selenium-session-queue

  < 4.35.0.20250828-r0

• chainguard•docker-selenium-sessions

  < 4.35.0.20250828-r0

• chainguard•docker-selenium-standalone

  < 4.35.0.20250828-r0

• chainguard•docker-selenium-standalone-chrome

  < 4.35.0.20250828-r0

• chainguard•docker-selenium-standalone-chromium

  < 4.35.0.20250828-r0

• chainguard•docker-selenium-standalone-docker

  < 4.35.0.20250828-r0

• chainguard•docker-selenium-standalone-firefox

  < 4.35.0.20250828-r0

• chainguard•docker-selenium-supervisor-config

  < 4.35.0.20250828-r0

• chainguard•druid

  < 34.0.0-r3

Showing first 50 affected entries in server-rendered view.

References (9)

• https://github.com/netty/netty/security/advisories/GHSA-3p8m-j85q-pgmj
• https://github.com/netty/netty/commit/9d804c54ce962408ae6418255a83a13924f7145d
• https://nvd.nist.gov/vuln/detail/CVE-2025-58057
• https://github.com/netty/netty
• https://security-tracker.debian.org/tracker/CVE-2025-58057
• https://ubuntu.com/security/CVE-2025-58057
• https://www.cve.org/CVERecord?id=CVE-2025-58057
• https://ubuntu.com/security/notices/USN-7918-1
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58057.json