Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack
Résumé
Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with specially crafted input, BrotliDecoder and certain other decompression decoders will allocate a large number of reachable byte buffers, which can lead to denial of service. BrotliDecoder.decompress has no limit in how often it calls pull, decompressing data 64K bytes at a time. The buffers are saved in the output list, and remain reachable until OOM is hit. This is fixed in versions 4.1.125.Final of netty-codec and 4.2.5.Final of netty-codec-compression.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2025-58057 netty Corrigé dans: 1:4.1.48-4+deb11u3
- Ubuntu UBUNTU-CVE-2025-58057 netty
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com