Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
☕
☕ Maven
Not in CISA KEV
MEDIUM severity

CVE-2025-25193 — netty-common

MEDIUMFix: netty/netty@d1fbda6

CVE-2025-25193 is a medium-severity (CVSS 5.5) Uncontrolled Resource Consumption vulnerability in io.netty:netty-common. A fix is available for io.netty:netty-common — see the affected versions and patch details below.

Denial of Service attack on windows app using Netty

Also known asGHSA-389x-839f-4rhx
Published
Feb 10, 2025
Updated
Aug 12, 2026
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Sep 26, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

Proof-of-concept exploit code exists

  • CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.

Exploitation and automatability from CISA’s SSVC triage for CVE-2025-25193.

EPSS Exploitation Probability

via FIRST.org ↗
0.4%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs31th percentile — riskier than 31% of all scored CVEsHighest risk

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

CVE-2025-25193 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 379,842 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.

Real-World Exposure

1 pkg affected
☕io.netty:netty-common

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

Summary

An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attemps to load a file that does not exist. If an attacker creates such a large file, the Netty application crash.

Details

A similar issue was previously reported in https://github.com/netty/netty/security/advisories/GHSA-xq3w-v528-46rv This issue was fixed, but the fix was incomplete in that null-bytes were not counted against the input limit.

PoC

The PoC is the same as for https://github.com/netty/netty/security/advisories/GHSA-xq3w-v528-46rv with the detail that the file should only contain null-bytes; 0x00. When the null-bytes are encountered by the InputStreamReader, it will issue replacement characters in its charset decoding, which will fill up the line-buffer in the BufferedReader.readLine(), because the replacement character is not a line-break character.

Impact

Impact is the same as https://github.com/netty/netty/security/advisories/GHSA-xq3w-v528-46rv

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
☕Mavenio.netty:netty-commonall versions4.1.118.Finalio.netty:netty-common:4.1.118.Final

Affected Products

1 product · 1 configurations
Application
nettynetty
< 4.1.118
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for io.netty:netty-common, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update io.netty:netty-common to 4.1.118.Final or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2025-25193 is resolved across your whole dependency graph.

  3. Workarounds

    Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatModerate

This issue only affects Windows environments, therefore, this would affect an environment when running a supported Red Hat JBoss EAP 7 or 8, for example, if running on Windows.

ProductFixed inAdvisory
Red Hat JBoss Enterprise Application Platformio.netty/netty-common:4.1.124.Final-redhat-00001RHSA-2025:3467
Red Hat JBoss Enterprise Application Platform 7.4.22io.netty/netty-common:4.1.119.Final-redhat-00004RHSA-2025:4552
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8eap7-netty-0:4.1.119-1.Final_redhat_00004.1.el8eapRHSA-2025:3465
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8eap7-apache-commons-io-0:2.16.1-1.redhat_00001.1.el8eapRHSA-2025:4549
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9eap7-apache-commons-io-0:2.16.1-1.redhat_00001.1.el9eapRHSA-2025:4550
Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7eap7-apache-commons-io-0:2.16.1-1.redhat_00001.1.el7eapRHSA-2025:4548
Red Hat JBoss Enterprise Application Platform 8netty-commonRHSA-2025:3358
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8eap8-eap-product-conf-parent-0:800.6.1-1.GA_redhat_00001.1.el8eapRHSA-2025:3357

Frequently Asked Questions

### Summary An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attemps to load a file that does not exist. If an attacker creates such a large file, the Netty application crash. ### Details A similar issue was previously reported in https://github.com/netty/netty/security/advisories/GHSA-xq3w-v528-46rv This issue was fixed, but the fix was incomplete in that null-bytes were not counted against the input limit. ### PoC The PoC is the same as for https://github.com/netty/netty/security/advisories/GHSA-xq3w-v
O3 Security · Impact-Aware SCA

Is CVE-2025-25193 in your dependencies?

Find it across Maven, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2025-25193: netty-common (Medium 5.5) | O3 Security