{"action":"Upgrade io.netty:netty-codec-http to 4.1.125.Final (4.1.x) or 4.2.5.Final (4.2.x) or later.","affected":[{"fixed":"4.1.125.Final","introduced":"0"},{"fixed":"4.2.5.Final","introduced":"4.2.0.Alpha1"}],"component":"io.netty:netty-codec-http","cve_ids":["CVE-2025-58056"],"ecosystem":"Maven","epss":0.0071,"exploited":false,"fixed_versions":["4.1.125.Final","4.2.5.Final"],"ghsa_id":"GHSA-fghv-69vj-qj49","id":"tcs_01M5N8VZKAVVY8AAWV661T656Z","modified_at":"2026-09-10T03:50:28.333050757Z","published_at":"2025-09-04T17:35:20Z","references":["https://osv.dev/vulnerability/GHSA-fghv-69vj-qj49","https://github.com/netty/netty/security/advisories/GHSA-fghv-69vj-qj49","https://nvd.nist.gov/vuln/detail/CVE-2025-58056","https://github.com/JLLeitschuh/unCVEed/issues/1","https://github.com/netty/netty/issues/15522","https://github.com/github/advisory-database/pull/6092","https://github.com/netty/netty/pull/15611","https://github.com/netty/netty/commit/edb55fd8e0a3bcbd85881e423464f585183d1284","https://datatracker.ietf.org/doc/html/rfc9112#name-chunked-transfer-coding","https://github.com/netty/netty","https://w4ke.info/2025/06/18/funky-chunks.html"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-fghv-69vj-qj49","url":"https://osv.dev/vulnerability/GHSA-fghv-69vj-qj49"},{"source":"nvd","source_id":"CVE-2025-58056","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58056"}],"summary":"Netty vulnerable to request smuggling due to incorrect parsing of chunk extensions"}