Skip to content
OpenAdvisories
Medium · 6.9 CVE-2025-58057 EUVD-2025-26649GHSA-3p8m-j85q-pgmj

Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack

Published Sep 3, 2025 · Updated Sep 4, 2025 · Assigned by GitHub_M

Vendor: netty Product: netty Package: akhq Package: apache-activemq-artemis Package: apache-activemq-artemis-compat Package: apache-nifi Package: apache-nifi-compat Package: apache-nifi-toolkit Package: apicurio-registry Package: apicurio-registry-nginx-config Package: apicurio-registry-ui Package: cassandra-5.0 Package: cassandra-5.0-compat Package: cassandra-5.0-entrypoint-compat Package: cassandra-5.0-iamguarded-compat Package: cassandra-reaper Package: celeborn-0.6 Package: cloudwatch-exporter Package: cqlsh-5.0 Package: docker-selenium Package: docker-selenium-base Package: docker-selenium-compat Package: docker-selenium-distributor Package: docker-selenium-event-bus Package: docker-selenium-hub Package: docker-selenium-node-base Package: docker-selenium-node-chromium Package: docker-selenium-node-docker Package: docker-selenium-node-firefox Package: docker-selenium-router Package: docker-selenium-session-queue Package: docker-selenium-sessions Package: docker-selenium-standalone Package: docker-selenium-standalone-chrome Package: docker-selenium-standalone-chromium Package: docker-selenium-standalone-docker Package: docker-selenium-standalone-firefox Package: docker-selenium-supervisor-config Package: druid Package: druid-compat Package: flyway Package: io.netty:netty-codec Package: io.netty:netty-codec-compression Package: kafka_exporter-strimzi-compat Package: kafka-strimzi-compat Package: kserve-modelmesh Package: kserve-modelmesh-compat Package: logstash-8-with-output-opensearch Package: management-api-for-apache-cassandra-5.0 Package: management-api-for-apache-cassandra-5.0-compat Package: netty Package: netty Package: opensearch-2 Package: prometheus-jmx-exporter-strimzi-compat Package: selenium-server Package: sonarqube Package: spark-4.0 Package: spark-4.0-scala-2.13 Package: spark-4.0-scala-2.13-compat Package: strimzi-kafka-operator Package: strimzi-kafka-operator-cluster-operator Package: strimzi-kafka-operator-kafka-agent Package: strimzi-kafka-operator-kafka-base Package: strimzi-kafka-operator-kafka-init Package: strimzi-kafka-operator-kafka-thirdparty-libs Package: strimzi-kafka-operator-kafka-thirdparty-libs-cc Package: strimzi-kafka-operator-topic-operator Package: strimzi-kafka-operator-tracing-agent Package: strimzi-kafka-operator-user-operator Package: tez Package: thingsboard Package: thingsboard-tb-js-executor Package: thingsboard-tb-mqtt-transport Package: thingsboard-tb-node Package: thingsboard-tb-web-ui Package: trino Package: trino-config Package: trino-oci-entrypoint Package: trino-plugin-ai-functions Package: trino-plugin-bigquery Package: trino-plugin-blackhole Package: trino-plugin-cassandra Package: trino-plugin-clickhouse Package: trino-plugin-delta-lake Package: trino-plugin-druid Package: trino-plugin-duckdb Package: trino-plugin-elasticsearch Package: trino-plugin-exasol Package: trino-plugin-exchange-filesystem Package: trino-plugin-exchange-hdfs Package: trino-plugin-faker Package: trino-plugin-functions-python Package: trino-plugin-geospatial Package: trino-plugin-google-sheets Package: trino-plugin-hive Package: trino-plugin-http-event-listener Package: trino-plugin-http-server-event-listener Package: trino-plugin-hudi Package: trino-plugin-iceberg Package: trino-plugin-ignite Package: trino-plugin-jmx Package: trino-plugin-kafka Package: trino-plugin-kafka-event-listener Package: trino-plugin-lakehouse Package: trino-plugin-ldap-group-provider Package: trino-plugin-loki Package: trino-plugin-mariadb Package: trino-plugin-memory Package: trino-plugin-ml Package: trino-plugin-mongodb Package: trino-plugin-mysql Package: trino-plugin-mysql-event-listener Package: trino-plugin-opa Package: trino-plugin-openlineage Package: trino-plugin-opensearch Package: trino-plugin-oracle Package: trino-plugin-password-authenticators Package: trino-plugin-pinot Package: trino-plugin-postgresql Package: trino-plugin-prometheus Package: trino-plugin-ranger Package: trino-plugin-redis Package: trino-plugin-redshift Package: trino-plugin-resource-group-managers Package: trino-plugin-session-property-managers Package: trino-plugin-singlestore Package: trino-plugin-snowflake Package: trino-plugin-spooling-filesystem Package: trino-plugin-sqlserver Package: trino-plugin-teradata-functions Package: trino-plugin-thrift Package: trino-plugin-tpcds Package: trino-plugin-tpch Package: trino-plugin-vertica Package: wavefront-proxy Package: wavefront-proxy-compat Package: wavefront-proxy-config Package: wavefront-proxy-licenses Package: wildfly Package: wildfly-openjdk-17 Package: wildfly-openjdk-17-compat Package: wildfly-openjdk-21 Package: wildfly-openjdk-21-compat Package: zipkin Package: zipkin-oci-entrypoint Package: zipkin-slim Package: zookeeper-3.9 Package: zookeeper-3.9-compat Package: zookeeper-3.9-iamguarded-compat Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with specially crafted input, BrotliDecoder and certain other decompression decoders will allocate a large number of reachable byte buffers, which can lead to denial of service. BrotliDecoder.decompress has no limit in how often it calls pull, decompressing data 64K bytes at a time. The buffers are saved in the output list, and remain reachable until OOM is hit. This is fixed in versions 4.1.125.Final of netty-codec and 4.2.5.Final of netty-codec-compression.

Affected products

VendorProductAffectedFixed
netty netty <= 4.1.124.Final, < 4.1.125.Final, <= 4.2.4.Final, < 4.2.5.Final —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 netty 1:4.1.48-12 —
Debian 13 netty 1:4.1.48-10+deb13u1 DSA-6160-1
Debian 12 netty 1:4.1.48-7+deb12u2 DSA-6160-1
Debian 11 netty 1:4.1.48-4+deb11u3 DLA-4519-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 25.10 netty 1:4.1.48-10ubuntu0.25.10.2 —
Ubuntu 24.04 LTS netty 1:4.1.48-9ubuntu0.1 —
Ubuntu 22.04 LTS netty 1:4.1.48-4+deb11u2ubuntu0.1 —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS netty 1:4.1.45-1ubuntu0.1~esm4 —
Ubuntu Pro 18.04 LTS netty 1:4.1.7-4ubuntu0.1+esm5 —
Ubuntu Pro 16.04 LTS netty No fix yet —
Ubuntu Pro 14.04 LTS netty No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 netty 4.1.126-150200.4.34.1 SUSE-SU-2025:03114-1
SLES 15 SP7 netty-tcnative 2.0.73-150200.3.30.1 SUSE-SU-2025:03114-1
SLES 15 SP6 netty 4.1.126-150200.4.34.1 SUSE-SU-2025:03114-1
SLES 15 SP6 netty-tcnative 2.0.73-150200.3.30.1 SUSE-SU-2025:03114-1
SLES 15 SP5 netty-tcnative 2.0.73-150200.3.30.1 SUSE-SU-2025:03114-1
SLES 15 SP4 netty-tcnative 2.0.73-150200.3.30.1 SUSE-SU-2025:03114-1
SLES 15 SP3 netty-tcnative 2.0.73-150200.3.30.1 SUSE-SU-2025:03114-1
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP5 netty-tcnative 2.0.73-150200.3.30.1 SUSE-SU-2025:03114-1
SLES for SAP 15 SP4 netty-tcnative 2.0.73-150200.3.30.1 SUSE-SU-2025:03114-1
SLES for SAP 15 SP3 netty-tcnative 2.0.73-150200.3.30.1 SUSE-SU-2025:03114-1
SLE HPC 15 SP5 netty-tcnative 2.0.73-150200.3.30.1 SUSE-SU-2025:03114-1
SLE HPC 15 SP4 netty-tcnative 2.0.73-150200.3.30.1 SUSE-SU-2025:03114-1
SLE HPC 15 SP3 netty-tcnative 2.0.73-150200.3.30.1 SUSE-SU-2025:03114-1
SUSE Enterprise Storage 7.1 netty-tcnative 2.0.73-150200.3.30.1 SUSE-SU-2025:03114-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed netty 4.1.126-1.1 openSUSE-SU-2025:15520-1
openSUSE Leap 15.6 netty 4.1.126-150200.4.34.1 SUSE-SU-2025:03114-1
openSUSE Leap 15.6 netty-tcnative 2.0.73-150200.3.30.1 SUSE-SU-2025:03114-1

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling akhq 0.26.0-r3 —
Wolfi rolling apache-activemq-artemis +1 2.42.0-r8 —
Wolfi rolling apache-nifi +2 2.5.0-r6 —
Wolfi rolling apicurio-registry +2 3.0.13-r1 —
Wolfi rolling cassandra-reaper 3.8.0-r11 —
Wolfi rolling celeborn-0.6 0.6.3-r7 —
Wolfi rolling cloudwatch-exporter 0.16.0-r7 —
Wolfi rolling cqlsh-5.0 +4 5.0.5-r5 —
Wolfi rolling docker-selenium +18 4.35.0.20250828-r0 —
Wolfi rolling druid +1 34.0.0-r3 —
Wolfi rolling flyway 11.11.2-r1 —
Wolfi rolling kafka-strimzi-compat +12 0.47.0-r7 —
Wolfi rolling kserve-modelmesh +1 0.12.0-r16 —
Wolfi rolling logstash-8-with-output-opensearch No fix yet —
Wolfi rolling management-api-for-apache-cassandra-5.0 +1 0.1.107-r2 —
Wolfi rolling opensearch-2 2.19.4-r0 —
Wolfi rolling selenium-server 4.38.0-r0 —
Wolfi rolling sonarqube 25.12.0.117093-r1 —
Wolfi rolling spark-4.0 +2 4.0.0-r4 —
Wolfi rolling tez 0.10.5-r16 —
Wolfi rolling thingsboard +4 4.2-r3 —
Wolfi rolling trino +58 476-r7 —
Wolfi rolling wavefront-proxy +3 13.8-r2 —
Wolfi rolling wildfly +4 37.0.1-r0 —
Wolfi rolling zipkin +2 3.5.1-r5 —
Wolfi rolling zookeeper-3.9 +2 3.9.4-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven io.netty:netty-codec < 4.1.125.Final 4.1.125.Final GHSA-3p8m-j85q-pgmj
Maven io.netty:netty-codec-compression >= 4.2.0.Alpha1, < 4.2.5.Final 4.2.5.Final GHSA-3p8m-j85q-pgmj

Advisories 20

References