netty up to 4.1.118 resource consumption

Summaryinfo

A vulnerability was found in netty up to 4.1.118. It has been classified as problematic. This issue affects some unknown processing. Performing a manipulation results in resource consumption. This vulnerability is reported as CVE-2025-25193. The attack requires a local approach. No exploit exists. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability, which was classified as problematic, was found in netty up to 4.1.118. This affects an unknown code block. The manipulation with an unknown input leads to a resource consumption vulnerability. CWE is classifying the issue as CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. This is going to have an impact on availability. The summary by CVE is:

Netty, an asynchronous, event-driven network application framework, has a vulnerability in versions up to and including 4.1.118.Final. An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attempts to load a file that does not exist. If an attacker creates such a large file, the Netty application crash. A similar issue was previously reported as CVE-2024-47535. This issue was fixed, but the fix was incomplete in that null-bytes were not counted against the input limit. Commit d1fbda62d3a47835d3fb35db8bd42ecc205a5386 contains an updated fix.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2025-25193 since 02/03/2025. The exploitability is told to be easy. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 216507 (SUSE SLED15 / SLES15 / openSUSE 15 Security Update : netty, netty-tcnative (SUSE-SU-2025:0590-1)), which helps to determine the existence of the flaw in a target environment.

Applying the patch d1fbda62d3a47835d3fb35db8bd42ecc205a5386 is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the databases at Tenable (216507) and CERT Bund (WID-SEC-2025-0638). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• IBM Maximo Asset Management
• IBM Operational Decision Manager
• IBM WebSphere Application Server
• IBM SPSS
• IBM Spectrum Protect
• HCL Commerce
• IBM QRadar SIEM
• IBM DB2
• IBM InfoSphere Information Server
• Red Hat JBoss Enterprise Application Platform
• HCL BigFix

Productinfo

Name

• netty

Version

• 4.1.118

License

• open-source

Website

• Product: https://github.com/netty/netty/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion