CVE-2025-58057: Netty's decoders vulnerable to DoS via zip bomb style attack
N/A
Basic Information
JavaTechnical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.netty:netty-codec-compression | maven | >= 4.2.0.Alpha1, < 4.2.5.Final | 4.2.5.Final |
| io.netty:netty-codec | maven | < 4.1.125.Final | 4.1.125.Final |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability is a classic denial-of-service issue caused by improper handling of highly compressed data, commonly known as a "zip bomb" attack. The root cause lies in several of Netty's decompression handlers (BrotliDecoder, JZlibDecoder, JdkZlibDecoder, ZstdDecoder) and the higher-level handlers that use them (HttpContentDecoder, DelegatingDecompressorFrameListener).
The vulnerable pattern, common to all affected components, was the use of an output list (List<Object> out) or an internal buffer to accumulate all the decompressed data from a compressed input stream before passing it down the pipeline. When a malicious, highly-compressed payload (a zip bomb) was processed, the decoder would enter a loop, decompressing small chunks of input into large chunks of output and adding each output buffer to the list. This caused the application's memory usage to grow uncontrollably, eventually leading to an java.lang.OutOfMemoryError and a denial of service.
The provided stack trace clearly shows the memory allocation failure originating from BrotliDecoder.pull, which was called by BrotliDecoder.decompress.
The patch addresses this by fundamentally changing the data flow. Instead of collecting buffers in a list, the modified decoders now immediately fire a channelRead event for each piece of decompressed data. This pushes the data down the pipeline as it becomes available, effectively streaming the output and preventing it from being buffered in memory. This change ensures that memory usage remains bounded, mitigating the DoS risk.