Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with specially crafted input, BrotliDecoder and certain other decompression decoders will allocate a large number of reachable byte buffers, which can lead to denial of service. BrotliDecoder.decompress has no limit in how often it calls pull, decompressing data 64K bytes at a time. The buffers are saved in the output list, and remain reachable until OOM is hit. This is fixed in versions 4.1.125.Final of netty-codec and 4.2.5.Final of netty-codec-compression.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Atlassian Jira | — | Upgrade to the latest version of Atlassian JIRA | Oct 23, 2025 | Oct 21, 2025 |
| Debian | — | Upgrade netty | Mar 13, 2026 | Mar 13, 2026 |
| Oracle Ebs | — | Apply the apr-2026 Critical Patch Update (CPU) (Patch ) for Oracle E-Business Suite | Apr 22, 2026 | Apr 14, 2026 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 5, 2025 | Sep 3, 2025 |
| Suse | — | Upgrade netty-tcnativeUpgrade netty-tcnative-javadocUpgrade netty-javadocUpgrade netty | Dec 5, 2025 | Sep 9, 2025 |
| Ubuntu | — | Upgrade libnetty-javaUpgrade libnetty-java (Ubuntu Pro) | Dec 10, 2025 | Sep 4, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub