Maven/io.netty:netty-codec-http CVE-2025-58056: high 7.5, EPSS 0.71%
Netty vulnerable to request smuggling due to incorrect parsing of chunk extensions
Action: Upgrade io.netty:netty-codec-http to 4.1.125.Final (4.1.x) or 4.2.5.Final (4.2.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 4.1.125.Final | - |
| 4.2.0.Alpha1 | 4.2.5.Final | - |
Fixed versions
| 4.1.125.Final | 4.2.5.Final |
Sources
- osv: GHSA-fghv-69vj-qj49
- nvd: CVE-2025-58056
- https://github.com/netty/netty/security/advisories/GHSA-fghv-69vj-qj49
- https://github.com/JLLeitschuh/unCVEed/issues/1
- https://github.com/netty/netty/issues/15522
- https://github.com/github/advisory-database/pull/6092
- https://github.com/netty/netty/pull/15611
- https://github.com/netty/netty/commit/edb55fd8e0a3bcbd85881e423464f585183d1284
- https://datatracker.ietf.org/doc/html/rfc9112#name-chunked-transfer-coding
- https://github.com/netty/netty
- https://w4ke.info/2025/06/18/funky-chunks.html
CVE-2025-58056 · published · modified · JSON