CVE-2025-25193: Denial of Service attack on windows app using Netty
Summary An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attemps to load a file that does not exist. If an attacker creates such a large file, the Netty application crash.
Details A similar issue was previously reported in https://github.com/netty/netty/security/advisories/GHSA-xq3w-v528-46rv This issue was fixed, but the fix was incomplete in that null-bytes were not counted against the input limit.
PoC The PoC is the same as for https://github.com/netty/netty/security/advisories/GHSA-xq3w-v528-46rv with the detail that the file should only contain null-bytes; 0x00. When the null-bytes are encountered by the InputStreamReader, it will issue replacement characters in its charset decoding, which will fill up the line-buffer in the BufferedReader.readLine(), because the replacement character is not a line-break character.
Impact Impact is the same as https://github.com/netty/netty/security/advisories/GHSA-xq3w-v528-46rv
Other sources
Netty, an asynchronous, event-driven network application framework, has a vulnerability in versions up to and including 4.1.118.Final. An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attempts to load a file that does not exist. If an attacker creates such a large file, the Netty application crash. A similar issue was previously reported as <a href="https://access.redhat.com/security/cve/CVE-2024-47535">CVE-2024-47535</a>. This issue was fixed, but the fix was incomplete in that null-bytes were not counted against the input limit. Commit d1fbda62d3a47835d3fb35db8bd42ecc205a5386 contains an updated fix.
— Red Hat
Netty, an asynchronous, event-driven network application framework, has a vulnerability in versions up to and including 4.1.118.Final. An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attempts to load a file that does not exist. If an attacker creates such a large file, the Netty application crash. A similar issue was previously reported as CVE-2024-47535. This issue was fixed, but the fix was incomplete in that null-bytes were not counted against the input limit. Commit d1fbda62d3a47835d3fb35db8bd42ecc205a5386 contains an updated fix.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-25193?
CVE-2025-25193 is categorized as a critical vulnerability due to its potential to cause denial of service.
How do I fix CVE-2025-25193?
To resolve CVE-2025-25193, upgrade to Netty version 4.1.119 or later.
Which versions of Netty are affected by CVE-2025-25193?
CVE-2025-25193 affects Netty versions up to and including 4.1.118.
What are the consequences of exploiting CVE-2025-25193?
Exploiting CVE-2025-25193 can lead to application crashes and unavailability due to denial of service.
Is CVE-2025-25193 applicable to Windows applications only?
Yes, CVE-2025-25193 specifically affects Netty running on Windows applications.