p PatchFirst

CVE-2025-58056

CVE-2025-58056 · Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients. In versions 4.1.124.Final, and 4.2.0.Alpha3 through 4.2.4.Final, Netty incorrectly accepts standalone newline characters (LF) as a chunk-size line terminator, regardless of a preceding carriage return (CR), instead of requiring CRLF per HTTP/1.1 standards. When combined with reverse proxies that parse LF differently (treating it as part of the chunk extension), attackers can craft requests that the proxy sees as one request but Netty processes as two, enabling request smuggling attacks. This is fixed in versions 4.1.125.Final and 4.2.5.Final.

CVSS 2.9 · Low · EPSS 0.7% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • netty

    Versions
    • >= 4.2.0.Alpha3, < 4.2.5.Final: Affected
    • <= 4.1.124.Final, < 4.1.125.Final: Affected

    No fix published

  • netty Debian:12

    Versions
    • 1:4.1.48-7
    • 1:4.1.48-7+deb12u1
    Affected ranges
    • ECOSYSTEM: < 1:4.1.48-7+deb12u2

    Update to 1:4.1.48-7+deb12u2

  • netty Debian:13

    Versions
    • 1:4.1.48-10
    Affected ranges
    • ECOSYSTEM: < 1:4.1.48-10+deb13u1

    Update to 1:4.1.48-10+deb13u1

  • netty Debian:14

    Versions
    • 1:4.1.48-10
    • 1:4.1.48-11
    • 1:4.1.48-12
    Affected ranges
    • ECOSYSTEM: < 1:4.1.48-13

    Update to 1:4.1.48-13

  • netty Ubuntu:Pro:14.04:LTS

    Versions
    • 1:3.2.6.Final-2
    • 1:3.2.6.Final-2+deb8u2build0.14.04.1~esm1
    • 1:3.2.6.Final-2+deb8u2ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • netty Ubuntu:Pro:16.04:LTS

    Versions
    • 1:3.2.6.Final-2
    • 1:4.0.32-1
    • 1:4.0.33-1
    • 1:4.0.34-1
    • 1:4.0.34-1ubuntu0.1~esm1
    • 1:4.0.34-1ubuntu0.1~esm2
    Affected ranges
    • ECOSYSTEM: < 1:4.0.34-1ubuntu0.1~esm3

    Update to 1:4.0.34-1ubuntu0.1~esm3

  • netty-3.9 Ubuntu:16.04:LTS

    Versions
    • 3.9.0.Final-1
    • 3.9.0.Final-1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • netty Ubuntu:Pro:18.04:LTS

    Versions
    • 1:4.1.7-4
    • 1:4.1.7-4ubuntu0.1~esm1
    • 1:4.1.7-4ubuntu0.1
    • 1:4.1.7-4ubuntu0.1+esm1
    • 1:4.1.7-4ubuntu0.1+esm2
    • 1:4.1.7-4ubuntu0.1+esm3
    • 1:4.1.7-4ubuntu0.1+esm4
    Affected ranges
    • ECOSYSTEM: < 1:4.1.7-4ubuntu0.1+esm5

    Update to 1:4.1.7-4ubuntu0.1+esm5

  • netty-3.9 Ubuntu:18.04:LTS

    Versions
    • 3.9.9.Final-1
    • 3.9.9.Final-1+deb9u1build0.18.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • netty Ubuntu:Pro:20.04:LTS

    Versions
    • 1:4.1.33-1
    • 1:4.1.33-2
    • 1:4.1.33-3
    • 1:4.1.45-1
    • 1:4.1.45-1ubuntu0.1~esm1
    • 1:4.1.45-1ubuntu0.1~esm2
    • 1:4.1.45-1ubuntu0.1~esm3
    Affected ranges
    • ECOSYSTEM: < 1:4.1.45-1ubuntu0.1~esm4

    Update to 1:4.1.45-1ubuntu0.1~esm4

  • netty Ubuntu:22.04:LTS

    Versions
    • 1:4.1.48-4
    • 1:4.1.48-4+deb11u1build0.22.04.1
    • 1:4.1.48-4+deb11u2build0.22.04.1
    Affected ranges
    • ECOSYSTEM: < 1:4.1.48-4+deb11u2ubuntu0.1

    Update to 1:4.1.48-4+deb11u2ubuntu0.1

  • netty Ubuntu:24.04:LTS

    Versions
    • 1:4.1.48-7
    • 1:4.1.48-8
    • 1:4.1.48-9
    Affected ranges
    • ECOSYSTEM: < 1:4.1.48-9ubuntu0.1

    Update to 1:4.1.48-9ubuntu0.1

  • netty Ubuntu:25.10

    Versions
    • 1:4.1.48-10
    • 1:4.1.48-10ubuntu0.25.10.1
    Affected ranges
    • ECOSYSTEM: < 1:4.1.48-10ubuntu0.25.10.2

    Update to 1:4.1.48-10ubuntu0.25.10.2

Original sources

Check your server →