What is CVE-2025-58057?

CVE-2025-58057 is a high-severity vulnerability in Netty, classified under Improper Handling of Highly Compressed Data (Data Amplification). CVSS score: 7.5/10. Published 2025-09-04.

How severe is CVE-2025-58057?

High severity. CVSS v3 base score is 7.5 out of 10.

Is CVE-2025-58057 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Netty

CVE-2025-58057

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with specially crafted input, BrotliDecoder and certain other decompression decoders will allocate a large number of reachable byte buffers, which can lead to denial of service. BrotliDecoder.decompress has no limit in how often it calls pull, decompressing data 64K bytes at a time. The buffers are saved in the output list, and remain reachable until OOM is hit. This is fixed in versions 4.1.125.Final of netty-codec and 4.2.5.Final of netty-codec-compression.

Published 2025-09-04 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

EPSS: 0.006 (46.6th percentile), scored 2026-09-29.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 47th percentile — 46.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: 0.000

Affected products

Netty — versions <= 4.1.124.Final, < 4.1.125.Final, <= 4.2.4.Final, < 4.2.5.Final

Weakness classification (CWE)

CWE-409 — Improper Handling of Highly Compressed Data (Data Amplification)

Public proof-of-concept exploits

meyayl/docker-languagetool

References

github.com/netty/netty/security/advisories/GHSA-3p8m-j85q-pgmj (Exploit, Vendor Advisory)
github.com/netty/netty/commit/9d804c54ce962408ae6418255a83a13924f7145d (Patch)

Frequently asked questions

What is CVE-2025-58057?: CVE-2025-58057 is a high-severity vulnerability in Netty, classified under Improper Handling of Highly Compressed Data (Data Amplification). CVSS score: 7.5/10. Published 2025-09-04.
How severe is CVE-2025-58057?: High severity. CVSS v3 base score is 7.5 out of 10.
Is CVE-2025-58057 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.