netty-codec: netty-codec-compression: Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack

A flaw was found in Netty. With specially crafted input, BrotliDecoder and some other decompressing decoders will allocate a large number of reachable byte buffers, which can lead to denial of service...

EUVD-2022-15674

Malicious code in bioql PyPI...

netty-codec: netty-codec-compression: Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack

A flaw was found in Netty. With specially crafted input, BrotliDecoder and some other decompressing decoders will allocate a large number of reachable byte buffers, which can lead to denial of service...

Security Bulletin: IBM SPSS Analytic Server is affected by multiple vulnerabilities in Netty Codec (CVE-2025-58056, CVE-2025-55163, CVE-2025-58057).

Summary IBM SPSS Analytic Server is affected by multiple vulnerabilities in Netty Codec CVE-2025-58056, CVE-2025-55163, CVE-2025-58057. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2025-55163 DESCRIPTION: Netty is an asynchronous, event-driven network...

Linux Distros Unpatched Vulnerability : CVE-2025-58057

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In...

OESA-2025-2149 netty security update

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers clients. %package help Summary: Documents for Buildarch: noarch Requires: man info Provides: -javadoc = - Obsoletes: -javadoc - %description help Man pages a...

SUSE CVE-2025-58057

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with specially crafted...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), africa.absa:inception-application (>=1.0.0, <=1.2.0) +41443 more potentially affected by CVE-2025-58056 via io.netty:netty-codec-http (>=4.0.0.alpha1, <=4.1.124.final)

io.netty:netty-codec-http MAVEN version =4.0.0.alpha1, =0.0.1, =1.0.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.6.0 - ai.ancf.lmos:lmos-router-hybrid 0.1.0 - ai.ancf.lmos:lmos-router-hybrid-spring-boot-starter 0.1.0 and more Source cves: CVE-2025-58056...

CVE-2025-58057: Improper Handling of Highly Compressed Data (Data Amplification)

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with specially crafted...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), africa.absa:inception-application (>=1.0.0, <=1.2.0) +41443 more potentially affected by CVE-2025-58057 via io.netty:netty-codec-http (>=4.0.0.alpha1, <=4.1.124.final)

io.netty:netty-codec-http MAVEN version =4.0.0.alpha1, =0.0.1, =1.0.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.6.0 - ai.ancf.lmos:lmos-router-hybrid 0.1.0 - ai.ancf.lmos:lmos-router-hybrid-spring-boot-starter 0.1.0 and more Source cves: CVE-2025-58057...

CVE-2025-58057

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with specially crafted...

at.aimit.mariella:persistence-kotlin (>=1.0.5, <=1.0.15), cloud.piranha.http:piranha-http-netty (>=25.4.0, <=25.6.0) +1248 more potentially affected by CVE-2025-58057 via io.netty:netty-codec-http2 (>=4.2.0.alpha1, <=4.2.4.final)

io.netty:netty-codec-http2 MAVEN version =4.2.0.alpha1, =1.0.5, =25.4.0, =25.4.0, =25.6.0 - cn.hserver:hserver 3.7.0 - cn.hserver:hserver-netty-web 4.0.0-beta.3 - cn.hserver:hserver-plugin-beetlsql 3.7.0 - cn.hserver:hserver-plugin-cloud 3.7.0 - cn.hserver:hserver-plugin-druid 3.7.0 -...

at.aimit.mariella:persistence-kotlin (>=1.0.5, <=1.0.15), cloud.piranha.http:piranha-http-netty (>=25.4.0, <=25.6.0) +1145 more potentially affected by CVE-2025-55163 via io.netty:netty-codec-http2 (>=4.2.0.alpha1, <=4.2.3.final)

io.netty:netty-codec-http2 MAVEN version =4.2.0.alpha1, =1.0.5, =25.4.0, =25.4.0, =25.6.0 - cn.hserver:hserver 3.7.0 - cn.hserver:hserver-netty-web 4.0.0-beta.3 - cn.hserver:hserver-plugin-beetlsql 3.7.0 - cn.hserver:hserver-plugin-cloud 3.7.0 - cn.hserver:hserver-plugin-druid 3.7.0 -...

at.aimit.mariella:persistence-kotlin (>=1.0.5, <=1.0.15), cloud.piranha.http:piranha-http-netty (>=25.4.0, <=25.6.0) +1145 more potentially affected by CVE-2025-55163 via io.netty:netty-codec-http2 (>=4.2.0.alpha1, <=4.2.3.final)

io.netty:netty-codec-http2 MAVEN version =4.2.0.alpha1, =1.0.5, =25.4.0, =25.4.0, =25.6.0 - cn.hserver:hserver 3.7.0 - cn.hserver:hserver-netty-web 4.0.0-beta.3 - cn.hserver:hserver-plugin-beetlsql 3.7.0 - cn.hserver:hserver-plugin-cloud 3.7.0 - cn.hserver:hserver-plugin-druid 3.7.0 -...

at.aimit.mariella:persistence-kotlin (>=1.0.5, <=1.0.15), cloud.piranha.http:piranha-http-netty (>=25.4.0, <=25.6.0) +1145 more potentially affected by CVE-2025-55163 via io.netty:netty-codec-http2 (>=4.2.0.alpha1, <=4.2.3.final)

io.netty:netty-codec-http2 MAVEN version =4.2.0.alpha1, =1.0.5, =25.4.0, =25.4.0, =25.6.0 - cn.hserver:hserver 3.7.0 - cn.hserver:hserver-netty-web 4.0.0-beta.3 - cn.hserver:hserver-plugin-beetlsql 3.7.0 - cn.hserver:hserver-plugin-cloud 3.7.0 - cn.hserver:hserver-plugin-druid 3.7.0 -...

Allocation of Resources Without Limits or Throttling

Overview io.netty:netty-codec-http2 is a HTTP2 sub package for the netty library, an event-driven asynchronous network application framework. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the improper handling of concurrently acti...

at.aimit.mariella:persistence-kotlin (>=1.0.5, <=1.0.15), cloud.piranha.http:piranha-http-netty (>=25.4.0, <=25.6.0) +1145 more potentially affected by CVE-2025-55163 via io.netty:netty-codec-http2 (>=4.2.0.alpha1, <=4.2.3.final)

io.netty:netty-codec-http2 MAVEN version =4.2.0.alpha1, =1.0.5, =25.4.0, =25.4.0, =25.6.0 - cn.hserver:hserver 3.7.0 - cn.hserver:hserver-netty-web 4.0.0-beta.3 - cn.hserver:hserver-plugin-beetlsql 3.7.0 - cn.hserver:hserver-plugin-cloud 3.7.0 - cn.hserver:hserver-plugin-druid 3.7.0 -...

netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data

A flaw was found in Netty's netty-codec due to size restrictions for decompressed data in the Bzip2Decoder. By sending a specially-crafted input, a remote attacker could cause a denial of service...

netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data

A flaw was found in Netty's netty-codec due to size restrictions for decompressed data in the Bzip2Decoder. By sending a specially-crafted input, a remote attacker could cause a denial of service...