Cyber Resilience

CVE-2025-58056

Netty ≤ 4.1.125

Public PoC
Published
03 September 2025
Modified
17 June 2026
Patch / advisory
View advisory
CVSS Score v4 2.9
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0063 47th percentile
Risk Priority 15 floored blend · peak EPSS

Summary

CVE-2025-58056 is a low-severity HTTP Request/Response Smuggling (CWE-444) vulnerability in Netty Netty. Its CVSS base score is 2.9 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 47th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A06:2025 Insecure Design

EU & UK References

Vulnerability Data

Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients. In versions 4.1.124.Final, and 4.2.0.Alpha3 through 4.2.4.Final, Netty incorrectly accepts standalone newline characters (LF) as a chunk-size line terminator, regardless of a…

more

preceding carriage return (CR), instead of requiring CRLF per HTTP/1.1 standards. When combined with reverse proxies that parse LF differently (treating it as part of the chunk extension), attackers can craft requests that the proxy sees as one request but Netty processes as two, enabling request smuggling attacks. This is fixed in versions 4.1.125.Final and 4.2.5.Final.

CWE(s)
CWE-444

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

The Netty vulnerability enables HTTP request smuggling by accepting standalone LF as chunk-size terminators instead of requiring CRLF, allowing attackers to craft requests that bypass reverse proxy parsing and exploit public-facing applications.

MITRE ATLAS TechniquesAI

MITRE ATLAS techniques

AML.T0040: AI Model Inference API AccessAML.T0048: External Harms

CVEs Like This One

CVE-2026-50020Same product: Netty Netty
CVE-2026-42581Same product: Netty Netty
CVE-2026-42585Same product: Netty Netty
CVE-2026-33870Same product: Netty Netty
CVE-2026-42580Same product: Netty Netty
CVE-2026-41417Same product: Netty Netty
CVE-2026-42584Same product: Netty Netty
CVE-2025-67735Same product: Netty Netty
CVE-2026-42579Same product: Netty Netty
CVE-2026-44893Same product: Netty Netty

Affected Assets

netty
netty
≤ 4.1.125 · 4.2.0 — 4.2.5

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-10 Information Input Validation
  • AC-4 Information Flow Enforcement
  • SC-7 Boundary Protection
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V4.1.3
  • V4.2.4
  • V1.5.3
  • V4.1.1

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Requires validation of all input (including HTTP chunk-size lines) against expected syntax such as strict CRLF terminators, directly blocking the LF-only parsing flaw that enables smuggling.

AC-4 Information Flow Enforcement partial match
prevent

Enforces information-flow rules on HTTP message boundaries so that requests are interpreted consistently between proxies and backend servers, mitigating inconsistent LF/CRLF handling.

SC-7 Boundary Protection partial match
prevent

Boundary-protection mechanisms (e.g., WAF or validated reverse-proxy rules) can reject non-standard chunked encodings before they reach a vulnerable Netty instance.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-01 mostly match
prevents

Configuration management can enforce uniform HTTP parsing rules across intermediaries, directly mitigating inconsistent interpretation.

DE.CM-01 partial match
prevents

Network monitoring can detect smuggling attempts via anomalous HTTP traffic or logs, while eliminating the inconsistency directly aids detection of such events.

PR.IR-01 partial match
prevents

Network protections can enforce consistent HTTP proxy/firewall behavior to block smuggling, and removing the weakness helps prevent unauthorized access via request smuggling.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
detects

Security testing can detect HTTP request smuggling vulnerabilities in intermediary components.

A.8.20 Networks security partial match
degrades

Network security controls can enforce consistent HTTP parsing and proxy behavior that mitigates request smuggling.

A.8.21 Security of network services partial match
degrades

Secure network services include hardening proxies and gateways against inconsistent HTTP interpretation.

A.8.25 Secure development life cycle partial match
prevents

Secure SDLC practices require threat modeling and testing for HTTP parsing inconsistencies in intermediaries.

A.8.26 Application security requirements partial match
prevents

Application security requirements can mandate strict HTTP message validation and canonicalization.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles include consistent protocol handling and defense-in-depth for proxies.

References