Security Bulletin: IBM SPSS Analytic Server is affected by multiple vulnerabilities in Netty Codec (CVE-2025-58056, CVE-2025-55163, CVE-2025-58057).

Summary IBM SPSS Analytic Server is affected by multiple vulnerabilities in Netty Codec CVE-2025-58056, CVE-2025-55163, CVE-2025-58057. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2025-55163 DESCRIPTION: Netty is an asynchronous, event-driven network...

Linux Distros Unpatched Vulnerability : CVE-2025-58057

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In...

OESA-2025-2149 netty security update

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers clients. %package help Summary: Documents for Buildarch: noarch Requires: man info Provides: -javadoc = - Obsoletes: -javadoc - %description help Man pages a...

SUSE CVE-2025-58057

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with specially crafted...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), africa.absa:inception-application (>=1.0.0, <=1.2.0) +41309 more potentially affected by CVE-2025-58056 via io.netty:netty-codec-http (>=4.0.0.alpha1, <=4.1.124.final)

io.netty:netty-codec-http MAVEN version =4.0.0.alpha1, =0.0.1, =1.0.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.6.0 - ai.ancf.lmos:lmos-router-hybrid 0.1.0 - ai.ancf.lmos:lmos-router-hybrid-spring-boot-starter 0.1.0 and more Source cves: CVE-2025-58056...

CVE-2025-58057: Improper Handling of Highly Compressed Data (Data Amplification)

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with specially crafted...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the...

CVE-2025-58057

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with specially crafted...

at.aimit.mariella:persistence-kotlin (>=1.0.5, <=1.0.15), cloud.piranha.http:piranha-http-netty (>=25.4.0, <=25.6.0) +1251 more potentially affected by CVE-2025-58057 via io.netty:netty-codec-http2 (>=4.2.0.alpha1, <=4.2.4.final)

io.netty:netty-codec-http2 MAVEN version =4.2.0.alpha1, =1.0.5, =25.4.0, =25.4.0, =25.6.0 - cn.hserver:hserver 3.7.0 - cn.hserver:hserver-netty-web 4.0.0-beta.3 - cn.hserver:hserver-plugin-beetlsql 3.7.0 - cn.hserver:hserver-plugin-cloud 3.7.0 - cn.hserver:hserver-plugin-druid 3.7.0 -...

at.aimit.mariella:persistence-kotlin (>=1.0.5, <=1.0.15), cloud.piranha.http:piranha-http-netty (>=25.4.0, <=25.6.0) +1145 more potentially affected by CVE-2025-55163 via io.netty:netty-codec-http2 (>=4.2.0.alpha1, <=4.2.3.final)

io.netty:netty-codec-http2 MAVEN version =4.2.0.alpha1, =1.0.5, =25.4.0, =25.4.0, =25.6.0 - cn.hserver:hserver 3.7.0 - cn.hserver:hserver-netty-web 4.0.0-beta.3 - cn.hserver:hserver-plugin-beetlsql 3.7.0 - cn.hserver:hserver-plugin-cloud 3.7.0 - cn.hserver:hserver-plugin-druid 3.7.0 -...

at.aimit.mariella:persistence-kotlin (>=1.0.5, <=1.0.15), cloud.piranha.http:piranha-http-netty (>=25.4.0, <=25.6.0) +1145 more potentially affected by CVE-2025-55163 via io.netty:netty-codec-http2 (>=4.2.0.alpha1, <=4.2.3.final)

io.netty:netty-codec-http2 MAVEN version =4.2.0.alpha1, =1.0.5, =25.4.0, =25.4.0, =25.6.0 - cn.hserver:hserver 3.7.0 - cn.hserver:hserver-netty-web 4.0.0-beta.3 - cn.hserver:hserver-plugin-beetlsql 3.7.0 - cn.hserver:hserver-plugin-cloud 3.7.0 - cn.hserver:hserver-plugin-druid 3.7.0 -...

Allocation of Resources Without Limits or Throttling

Overview io.netty:netty-codec-http2 is a HTTP2 sub package for the netty library, an event-driven asynchronous network application framework. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the improper handling of concurrently acti...

at.aimit.mariella:persistence-kotlin (>=1.0.5, <=1.0.15), cloud.piranha.http:piranha-http-netty (>=25.4.0, <=25.6.0) +1145 more potentially affected by CVE-2025-55163 via io.netty:netty-codec-http2 (>=4.2.0.alpha1, <=4.2.3.final)

io.netty:netty-codec-http2 MAVEN version =4.2.0.alpha1, =1.0.5, =25.4.0, =25.4.0, =25.6.0 - cn.hserver:hserver 3.7.0 - cn.hserver:hserver-netty-web 4.0.0-beta.3 - cn.hserver:hserver-plugin-beetlsql 3.7.0 - cn.hserver:hserver-plugin-cloud 3.7.0 - cn.hserver:hserver-plugin-druid 3.7.0 -...

netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data

A flaw was found in Netty's netty-codec due to size restrictions for decompressed data in the Bzip2Decoder. By sending a specially-crafted input, a remote attacker could cause a denial of service...

netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data

A flaw was found in Netty's netty-codec due to size restrictions for decompressed data in the Bzip2Decoder. By sending a specially-crafted input, a remote attacker could cause a denial of service...

netty-codec-http: Allocation of Resources Without Limits or Throttling

A flaw was found in the io.netty:netty-codec-http package. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling issues due to the accumulation of data in the HttpPostRequestDecoder. The decoder cumulates bytes in the undecodedChunk buffer until ...

Moderate: Red Hat Security Advisory: Migration Toolkit for Runtimes security, bug fix and enhancement update

Migration Toolkit for Runtimes 1.2.7 release Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

netty-codec-http: Allocation of Resources Without Limits or Throttling

A flaw was found in the io.netty:netty-codec-http package. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling issues due to the accumulation of data in the HttpPostRequestDecoder. The decoder cumulates bytes in the undecodedChunk buffer until ...

netty-codec-http: Allocation of Resources Without Limits or Throttling

A flaw was found in the io.netty:netty-codec-http package. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling issues due to the accumulation of data in the HttpPostRequestDecoder. The decoder cumulates bytes in the undecodedChunk buffer until ...

RHEL 9 : Red Hat JBoss Enterprise Application Platform 8.0.3 Security update (Important) (RHSA-2024:5481)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:5481 advisory. Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime. This release o...