UBUNTU-CVE-2025-58057

Description

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with specially crafted input, BrotliDecoder and certain other decompression decoders will allocate a large number of reachable byte buffers, which can lead to denial of service. BrotliDecoder.decompress has no limit in how often it calls pull, decompressing data 64K bytes at a time. The buffers are saved in the output list, and remain reachable until OOM is hit. This is fixed in versions 4.1.125.Final of netty-codec and 4.2.5.Final of netty-codec-compression.

CVSS Metrics

• v4.0•MEDIUM•Score: 6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
• v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Systems

• ubuntu•netty

  all | < 1:4.1.7-4ubuntu0.1+esm5 | < 1:4.1.45-1ubuntu0.1~esm4 | < 1:4.1.48-4+deb11u2ubuntu0.1 | < 1:4.1.48-9ubuntu0.1 | < 1:4.1.48-10ubuntu0.25.10.2

References (5)

• https://ubuntu.com/security/CVE-2025-58057
• https://www.cve.org/CVERecord?id=CVE-2025-58057
• https://github.com/netty/netty/security/advisories/GHSA-3p8m-j85q-pgmj
• https://github.com/netty/netty/commit/9d804c54ce962408ae6418255a83a13924f7145d
• https://ubuntu.com/security/notices/USN-7918-1