Vulnerability in Netty
CVE-2025-58056
Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients. In versions 4.1.124.Final, and 4.2.0.Alpha3 through 4.2.4.Final, Netty incorrectly accepts standalone newline characters (LF) as a chunk-size line terminator, regardless of a preceding carriage return (CR), instead of requiring CRLF per HTTP/1.1 standards. When combined with reverse proxies that parse LF differently (treating it as part of the chunk extension), attackers can craft requests that the proxy sees as one request but Netty processes as two, enabling request smuggling attacks. This is fixed in versions 4.1.125.Final and 4.2.5.Final.
Vulnerability class: HTTP Request Smuggling
EPSS: 0.006 (46.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.
Affected products
- Netty — versions >= 4.2.0.Alpha3, < 4.2.5.Final, <= 4.1.124.Final, < 4.1.125.Final
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
- security-advisories@github.com (Third Party Advisory, x_refsource_MISC, Issue Tracking)
- security-advisories@github.com (x_refsource_MISC, Issue Tracking)
- security-advisories@github.com (Patch, x_refsource_MISC, Issue Tracking)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (Technical Description, x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC, Broken Link)
Frequently asked questions
- What is CVE-2025-58056?
- CVE-2025-58056 is a high-severity vulnerability in Netty, classified under Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling). CVSS score: 7.5/10. Published 2025-09-03.
- How severe is CVE-2025-58056?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2025-58056 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.