CVE-2025-58057— Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-58057
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack
Source: NVD (National Vulnerability Database)
Vulnerability Description
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with specially crafted input, BrotliDecoder and certain other decompression decoders will allocate a large number of reachable byte buffers, which can lead to denial of service. BrotliDecoder.decompress has no limit in how often it calls pull, decompressing data 64K bytes at a time. The buffers are saved in the output list, and remain reachable until OOM is hit. This is fixed in versions 4.1.125.Final of netty-codec and 4.2.5.Final of netty-codec-compression.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
对高度压缩数据的处理不恰当(数据放大攻击)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Netty 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Netty是Netty社区的一款非阻塞I/O客户端-服务器框架，它主要用于开发Java网络应用程序，如协议服务器和客户端等。 Netty 4.1.124.Final及之前版本和4.2.4.Final及之前版本存在安全漏洞，该漏洞源于BrotliDecoder和其他解压缩解码器在处理特制输入时分配大量可访问字节缓冲区，可能导致拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-58057
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-58057
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: netty
- CVE-2026-41417
Netty vulnerable to HTTP request smuggling and RTSP request - CVE-2026-33871
Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Fram - CVE-2026-33870
Netty: HTTP Request Smuggling via Chunked Extension Quoted-S - CVE-2025-67735
Netty has a CRLF Injection vulnerability in io.netty.handler - CVE-2025-59419
Netty netty-codec-smtp SMTP Command Injection Vulnerability
Same vendor: netty
- CVE-2026-41417
Netty vulnerable to HTTP request smuggling and RTSP request - CVE-2026-33871
Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Fram - CVE-2026-33870
Netty: HTTP Request Smuggling via Chunked Extension Quoted-S - CVE-2025-67735
Netty has a CRLF Injection vulnerability in io.netty.handler - CVE-2025-59419
Netty netty-codec-smtp SMTP Command Injection Vulnerability
Same weakness: CWE-409
- CVE-2026-27460
Tandoor Recipes Affected by Denial of Service via Recipe Imp - CVE-2026-40148
PraisonAI Affected by Decompression Bomb DoS via Recipe Bund - CVE-2026-39373
JWCrypto: JWE ZIP decompression bomb - CVE-2026-3114
Zip Bomb Denial of Service via Unrestricted Archive Decompre - CVE-2026-32044
OpenClaw < 2026.3.2 - Tar Archive Safety Bypass in Skills In
V. Comments for CVE-2025-58057
No comments yet