CVE-2025-58057

Description

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with specially crafted input, BrotliDecoder and certain other decompression decoders will allocate a large number of reachable byte buffers, which can lead to denial of service. BrotliDecoder.decompress has no limit in how often it calls pull, decompressing data 64K bytes at a time. The buffers are saved in the output list, and remain reachable until OOM is hit. This is fixed in versions 4.1.125.Final of netty-codec and 4.2.5.Final of netty-codec-compression.

How to fix CVE-2025-58057

To remediate CVE-2025-58057, upgrade the affected package to a fixed version below.

• —upgrade to 1:4.1.48-4+deb11u3 or later
• —upgrade to 4.1.125.Final or later
• —upgrade to 4.2.5.Final or later

Is CVE-2025-58057 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (3)

• from 0, < 1:4.1.48-4+deb11u3
• from 0, < 4.1.125.Final
• >= 4.2.0.Alpha1, < 4.2.5.Final

CVSS scores

References (5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2025-58057
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2025-58057
• PATCHgithub.com/netty/netty
• WEBgithub.com/netty/netty/commit/9d804c54ce962408ae6418255a83a13924f7145d