Skip to main content
HIGH

CVE-2025-58056

CVSS v3

7.5

HIGH

EPSS Score

0.7 %

exploit probability, as of 2026-10-19

CISA KEV

No

known exploited

Exploitation

—

SSVC status

Get an alert for each new CVE published for netty-codec-http.

Set up CVE WatchFree account · no credit card

Affected and fixed versions

Packages from OSV.dev and products from the vendors' CSAF advisories.

version not verifiedVersions not verified: read as OSV.dev and the vendors publish them, not checked against each vendor's release list.

Packages

  • io.netty:netty-codec-httpMavenfrom 4.2.0.Alpha1 · fixed in 4.2.5.Final

Vendor advisories

  • CVE-2025-58056 Red Hat Product Security282 products fixed · 45 known affected

    netty-codec-http: Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions

    netty-codec-http2 as a component of Cryostat 4 · netty-codec-http as a component of Logging Subsystem for Red Hat OpenShift · netty-codec-http2 as a component of Logging Subsystem for Red Hat OpenShift

  • RHSA-2026:34608 Red Hat Product Security1 product fixed

    Red Hat Security Advisory: Streams for Apache Kafka 2.9.4 release and security update

  • RHSA-2026:3102 Red Hat Product Security1 product fixed

    Red Hat Security Advisory: AMQ Clients 2026.Q1

  • RHSA-2025:23417 Red Hat Product Security1 product fixed

    Red Hat Security Advisory: Streams for Apache Kafka 3.1.0 release and security update

  • RHSA-2025:21148 Red Hat Product Security20 products fixed

    Red Hat Security Advisory: Red Hat build of Cryostat 4.1.0: new RHEL 9 container image security update

  • RHSA-2025:18076 Red Hat Product Security1 product fixed

    Red Hat Security Advisory: Red Hat Build of Apache Camel 4.10 for Quarkus 3.20 update is now available (RHBQ 3.20.3.GA)

8 more advisories

Full record on NVD

Description

Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients. In versions 4.1.124.Final, and 4.2.0.Alpha3 through 4.2.4.Final, Netty incorrectly accepts standalone newline characters (LF) as a chunk-size line terminator, regardless of a preceding carriage return (CR), instead of requiring CRLF per HTTP/1.1 standards. When combined with reverse proxies that parse LF differently (treating it as part of the chunk extension), attackers can craft requests that the proxy sees as one request but Netty processes as two, enabling request smuggling attacks. This is fixed in versions 4.1.125.Final and 4.2.5.Final.

Technical details

Published
2025-09-03

Frequently asked questions

What is CVE-2025-58056?

Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients. In versions 4.1.124.Final, and 4.2.0.Alpha3 through 4.2.4.Final, Netty incorrectly accepts standalone newline characters (LF) as a chunk-size line terminator, regardless of a preceding carriage return (CR), instead of requiring CRLF per HTTP/1.1 standards. When combined with reverse proxies that parse LF differently (treating it as part of the chunk extension), attackers can craft requests that the proxy sees as one request but Netty processes as two, enabling request smuggling attacks. This is fixed in versions 4.1.125.Final and 4.2.5.Final.

Is CVE-2025-58056 actively exploited?

Active exploitation of CVE-2025-58056 has not been confirmed. Its EPSS score was 0.7% on 2026-10-19, the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2025-58056?

CVE-2025-58056 has a CVSS v3 base score of 7.5 (HIGH severity).

Running netty-codec-http? Hear about its next vulnerability

CVE Watch matches each new CVE to the vendors and products you list (vendor and product, not the version) and puts it in your alerts with its KEV and EPSS status.

Get alerts for this productCISA KEV additions, October 2026Search CVEs

Already have an account? Open CVE WatchNo credit card required · No monthly cap on website lookups · 250 API requests/month

Go further

Related vulnerabilities

Same product first, then the same vendor advisory and the same publication week.

Back to CVE Database