Read the docs
TI-2025-35900 Aliases CVE-2025-58057GHSA-3p8m-j85q-pgmj

Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack

Priority MEDIUM 64CWE-409Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Partial Red Hat: 5 fixed, 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with specially crafted input, BrotliDecoder and certain other decompression decoders will allocate a large number of reachable byte buffers, which can lead to denial of service. BrotliDecoder.decompress has no limit in how often it calls pull, decompressing data 64K bytes at a time. The buffers are saved in the output list, and remain reachable until OOM is hit. This is fixed in versions 4.1.125.Final of netty-codec and 4.2.5.Final of netty-codec-compression.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00631 50th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial io.netty:netty-codec-compression (Maven): 4.2.5.Finalio.netty:netty-codec (Maven): 4.1.125.FinalRed Hat: 5 advisoriesRed Hat: 5 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nettynetty<= 4.1.124.Final, < 4.1.125.Final; <= 4.2.4.Final, < 4.2.5.Final—No fix listedCNA
—io.netty:netty-codec-compression (Maven)4.2.0.Alpha1 to before 4.2.5.Final4.2.5.FinalPatch availableGHSA-3p8m-j85q-pgmj
—io.netty:netty-codec (Maven)before 4.1.125.Final4.1.125.FinalPatch availableGHSA-3p8m-j85q-pgmj
  • netty Vendornetty Affected <= 4.1.124.Final, < 4.1.125.Final; <= 4.2.4.Final, < 4.2.5.Final Fixed in — No fix listed CNA
  • io.netty:netty-codec-compression (Maven) Vendor— Affected 4.2.0.Alpha1 to before 4.2.5.Final Fixed in 4.2.5.Final Patch available GHSA-3p8m-j85q-pgmj
  • io.netty:netty-codec (Maven) Vendor— Affected before 4.1.125.Final Fixed in 4.1.125.Final Patch available GHSA-3p8m-j85q-pgmj

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*before 4.1.125; 4.2.0 to before 4.2.5Vulnerablenetty
  • cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* Versions before 4.1.125; 4.2.0 to before 4.2.5 Vulnerable ·netty

Remediation

  • Fix · GHSA-3p8m-j85q-pgmj io.netty:netty-codec-compression (Maven) Fixed in 4.2.5.Final Advisory →
  • Fix · GHSA-3p8m-j85q-pgmj io.netty:netty-codec (Maven) Fixed in 4.1.125.Final Advisory →

Red Hat 5 advisories

  • RHSA-2026:3951 Released 2026-03-05 · Red Hat rating Important
    JBoss EAP XP 5.0 Update 4.0 release. See references for release notes.
    • Red Hat JBoss EAP XP 5.0 Update 4.0
  • RHSA-2025:23417 Released 2025-12-16 · Red Hat rating Important
    Streams for Apache Kafka 3.1.0 release and security update
    • Streams for Apache Kafka 3.1.0
  • RHSA-2025:19077 Released 2025-10-23 · Red Hat rating Important
    Streams for Apache Kafka 2.9.3 release and security update
    • Streams for Apache Kafka 2.9.3
Show 2 more Red Hat advisories
  • RHSA-2025:17563 Released 2025-10-14 · Red Hat rating Moderate
    Red Hat build of Quarkus 3.20.3 release and security update
    • Red Hat build of Quarkus 3.20.3.redhat io.netty.netty-codec-4.1.127.Final-redhat-00001.jar, io.netty.netty-codec-http-4.1.127.Final-redhat-00001.jar
  • RHSA-2025:17187 Released 2025-10-02 · Red Hat rating Moderate
    Red Hat build of Quarkus 3.15.7 release and security update
    • Red Hat build of Quarkus 3.15.7

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix yet
Red Hat JBoss EAP XP 5.0 Update 4.0Fixed RHSA-2026:3951
Red Hat build of Quarkus 3.15.7Fixed RHSA-2025:17187
Red Hat build of Quarkus 3.20.3.redhatFixed RHSA-2025:17563
Streams for Apache Kafka 2.9.3Fixed RHSA-2025:19077
Streams for Apache Kafka 3.1.0Fixed RHSA-2025:23417
Not affected: 25 products
  • Cryostat 4
  • Logging Subsystem for Red Hat OpenShift
  • OpenShift Serverless
  • Red Hat AMQ Broker 7
  • Red Hat AMQ Clients
  • Red Hat Data Grid 8
  • Red Hat Fuse 7
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat Offline Knowledge Portal
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Dev Spaces
  • Red Hat Process Automation 7
  • Red Hat Satellite 6
  • Red Hat Single Sign-On 7
  • Red Hat build of Apache Camel - HawtIO 4
  • Red Hat build of Apache Camel 4 for Quarkus 3
  • Red Hat build of Apache Camel for Spring Boot 4
  • Red Hat build of Apicurio Registry 2
  • Red Hat build of Apicurio Registry 3
  • Red Hat build of Debezium 2
  • Red Hat build of Debezium 3
  • Red Hat build of OptaPlanner 8
  • Red Hat build of Quarkus 3.20.3.redhat
  • streams for Apache Kafka 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-58057
  2. 2026-10-03 Alias added: GHSA-3p8m-j85q-pgmj
  3. 2026-10-20 Fix available: Red Hat build of Quarkus 3.20.3.redhat · Red Hat
  4. 2026-10-27 EPSS moved to the 50th–90th percentile

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-30861 Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization CVSS 3.1CRITICAL 9.8
  • TI-2026-30864 Netty: HttpClientCodec response desynchronization CVSS 3.1CRITICAL 9.1
  • TI-2026-30859 Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) CVSS 3.1CRITICAL 9.1
  • TI-2026-40973 Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks CVSS 3.1CRITICAL 9.1
  • TI-2026-40972 Uncontrolled resource consumption in netty CVSS 3.1HIGH 7.5
See all 92 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences