CVE-2025-58057 in Netty
Summary
by MITRE • 09/04/2025
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with specially crafted input, BrotliDecoder and certain other decompression decoders will allocate a large number of reachable byte buffers, which can lead to denial of service. BrotliDecoder.decompress has no limit in how often it calls pull, decompressing data 64K bytes at a time. The buffers are saved in the output list, and remain reachable until OOM is hit. This is fixed in versions 4.1.125.Final of netty-codec and 4.2.5.Final of netty-codec-compression.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/25/2025
The vulnerability identified as CVE-2025-58057 affects Netty, a widely-used asynchronous event-driven network application framework that enables developers to build high-performance protocol servers and clients. This security flaw specifically impacts versions of netty-codec-compression up to 4.1.124.Final and netty-codec versions up to 4.2.4.Final, creating a significant risk for applications that rely on compression handling capabilities. The issue stems from insufficient input validation and resource management within the BrotliDecoder implementation, which processes compressed data streams for various network protocols.
The technical flaw manifests when the BrotliDecoder encounters specially crafted malicious input that triggers excessive buffer allocation during decompression operations. The decoder's decompress method lacks proper iteration limits, allowing it to repeatedly call the pull function and decompress data in 64K byte chunks without adequate bounds checking. This behavior results in the accumulation of numerous reachable byte buffers within the output list structure, with each buffer remaining accessible in memory until the system encounters an out-of-memory condition. The vulnerability is particularly concerning because it operates at the decompression layer where network traffic is processed, making it exploitable through crafted network requests.
From an operational perspective, this vulnerability creates a reliable denial of service condition that can be triggered by malicious actors sending specially constructed compressed data packets to vulnerable Netty applications. The resource exhaustion occurs gradually as buffers accumulate in memory, eventually leading to application crashes or complete service unavailability. The impact extends beyond simple service disruption since many applications depend on Netty for critical network operations, potentially affecting entire systems or services that utilize compression protocols. Attackers can exploit this weakness with minimal resources, making it particularly dangerous in production environments where availability is paramount.
The vulnerability maps to CWE-400, which addresses uncontrolled resource consumption, and aligns with ATT&CK technique T1499.004 for network denial of service attacks. Organizations using affected Netty versions should prioritize immediate patching to version 4.1.125.Final of netty-codec and 4.2.5.Final of netty-codec-compression, which implement proper bounds checking and memory management. Additional mitigations include implementing input validation controls, setting resource limits on decompression operations, and monitoring for unusual buffer allocation patterns in network applications. The fix addresses the root cause by introducing iteration limits and proper buffer management practices that prevent the accumulation of excessive reachable memory objects during decompression processes.