CVE-2025-58056

LOW EPSS 45.7%
Published Sep 3, 20259mo ago · Modified Jun 17, 20261w ago
2.9 CVSS 4.0
Low
Find Similar
Published Sep 3, 2025 9mo ago
Last Modified Jun 17, 2026 1w ago

Description

Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients. In versions 4.1.124.Final, and 4.2.0.Alpha3 through 4.2.4.Final, Netty incorrectly accepts standalone newline characters (LF) as a chunk-size line terminator, regardless of a preceding carriage return (CR), instead of requiring CRLF per HTTP/1.1 standards. When combined with reverse proxies that parse LF differently (treating it as part of the chunk extension), attackers can craft requests that the proxy sees as one request but Netty processes as two, enabling request smuggling attacks. This is fixed in versions 4.1.125.Final and 4.2.5.Final.

CVSS Details

Base Score
2.9
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
45.7% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-444

Affected Products 2

VendorProductVersionRange
nettynetty* <4.1.125
nettynetty*≥4.2.0  –  <4.2.5

References 7

  • datatracker.ietf.org https://datatracker.ietf.org/doc/html/rfc9112#name-chunked-transfer-coding
    Technical Description
  • github.com https://github.com/JLLeitschuh/unCVEed/issues/1
    Issue TrackingThird Party Advisory
  • github.com https://github.com/netty/netty/commit/edb55fd8e0a3bcbd85881e423464f585183d1284
    Patch
  • github.com https://github.com/netty/netty/issues/15522
    Issue Tracking
  • github.com https://github.com/netty/netty/pull/15611
    Issue TrackingPatch
  • github.com https://github.com/netty/netty/security/advisories/GHSA-fghv-69vj-qj49
    ExploitVendor Advisory
  • w4ke.info https://w4ke.info/2025/06/18/funky-chunks.html
    Broken Link

Remediation

  • github.com https://github.com/netty/netty/commit/edb55fd8e0a3bcbd85881e423464f585183d1284
    Patch
  • github.com https://github.com/netty/netty/pull/15611
    Issue TrackingPatch