Loading vulnerability…
Netty decompression decoder memory-exhaustion denial of service
CVE-2025-58057 is an unbounded memory-allocation vulnerability in Netty decompression decoders, notably BrotliDecoder, affecting the 4.1 release line through 4.1.124.Final and the 4.2 release line through 4.2.4.Final. When processing specially crafted compressed input, BrotliDecoder.decompress repeatedly calls pull without limiting the number of calls, producing decompressed buffers in 64 KiB chunks. These buffers accumulate in the output list and remain reachable, allowing memory consumption to increase until an out-of-memory condition causes denial of service. Certain other decompression decoders are also affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker can exhaust memory in an application processing malicious compressed input, causing an OutOfMemoryError and disrupting service availability. Other workloads sharing the affected JVM may also be disrupted. No confidentiality or integrity impact is identified.
If you can’t patch tonight, do this now.
Until patched, avoid processing untrusted input with BrotliDecoder or other affected decompression decoders. Where decompression is necessary, enforce decompressed-output limits during decoding, before excessive buffers accumulate. Rate limiting and JVM memory isolation can reduce exposure or contain the impact but do not correct the vulnerability.
Patch, then assume compromise.
Upgrade io.netty:netty-codec to 4.1.125.Final or later in the 4.1 release line, or io.netty:netty-codec-compression to 4.2.5.Final or later in the 4.2 release line. Update transitive dependencies and bundled product components so the deployed application actually uses the fixed Netty libraries. For vendor-managed products, install the corresponding vendor release containing the Netty fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
31 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.