CVE-2025-25193: Netty Denial of Service Vulnerability

CVE-2025-25193 Overview

CVE-2025-25193 is a denial of service vulnerability affecting Netty, an asynchronous, event-driven network application framework. This vulnerability exists in versions up to and including 4.1.118.Final and specifically impacts Netty applications running on Windows systems. When Netty is loaded on a Windows application, it attempts to read an environment file that does not exist. An attacker who creates a maliciously crafted large file at this location can cause the Netty application to crash.

This vulnerability is related to a previously reported issue tracked as CVE-2024-47535. While that issue was addressed, the fix was incomplete as null-bytes were not counted against the input limit, allowing the bypass of the original mitigation.

Critical Impact

A local attacker with low privileges can cause a denial of service by crashing Netty-based applications running on Windows through a crafted large environment file.

Affected Products

• Netty versions up to and including 4.1.118.Final
• Microsoft Windows (as the vulnerable environment file reading behavior is Windows-specific)
• Applications built on Netty framework running on Windows

Discovery Timeline

• 2025-02-10 - CVE-2025-25193 published to NVD
• 2025-06-11 - Last updated in NVD database

Technical Details for CVE-2025-25193

Vulnerability Analysis

This vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption). The root of the issue lies in how Netty handles input stream reading, specifically in the BoundedInputStream class. The original fix for CVE-2024-47535 implemented an input limit to prevent reading excessively large files, but the implementation had a flaw: null-bytes (which have a value of -1 when read) were not properly counted against this limit.

When running on Windows, Netty attempts to load a specific environment file. If an attacker with local access creates a large file at the expected path, the application will attempt to read it. Due to the incomplete fix, files containing null-bytes could bypass the size restrictions, leading to resource exhaustion and application crash.

Root Cause

The vulnerability stems from an improper boundary check in the BoundedInputStream.read() method. The original code checked if the byte read was greater than 0 (b > 0) before incrementing the byte counter. This logic failed to account for null-bytes (byte value 0) and the end-of-stream indicator (-1), meaning null-bytes were not counted against the input limit. This allowed an attacker to craft a file with null-bytes that would bypass the intended resource consumption limits.

Attack Vector

The attack requires local access to the Windows system running the vulnerable Netty application. An attacker with low privileges can:

1. Identify the location where Netty attempts to read the environment file on Windows
2. Create a maliciously crafted large file at that location, potentially filled with null-bytes to bypass the original input limit
3. Trigger the Netty application to read the file, causing resource exhaustion and application crash

The following patch demonstrates the fix applied in commit d1fbda62d3a47835d3fb35db8bd42ecc205a5386:

         checkMaxBytesRead();
 
         int b = super.read();
-        if (b > 0) {
+        if (b != -1) {
             numRead++;
         }
-
-        checkMaxBytesRead();
         return b;
     }
 

Source: GitHub Commit Changes

The fix changes the condition from b > 0 to b != -1, ensuring all bytes including null-bytes are counted against the input limit, while only excluding the end-of-stream indicator (-1).

Detection Methods for CVE-2025-25193

Indicators of Compromise

• Unexpected large files appearing in Netty's expected environment file locations on Windows systems
• Netty-based application crashes with memory exhaustion or resource consumption errors
• Unusual file access patterns to system directories where Netty reads configuration files

Detection Strategies

• Monitor for creation of unusually large files in directories where Netty applications read configuration or environment files
• Implement file integrity monitoring on Windows systems running Netty-based applications
• Configure application crash monitoring to alert on Netty process terminations with resource exhaustion indicators

Monitoring Recommendations

• Enable detailed logging for Netty applications to capture file reading operations
• Set up alerts for application crashes related to memory or resource exhaustion on Windows servers running Netty
• Monitor system resource utilization for sudden spikes in memory consumption by Netty processes

How to Mitigate CVE-2025-25193

Immediate Actions Required

• Upgrade Netty to a version that includes commit d1fbda62d3a47835d3fb35db8bd42ecc205a5386 or later
• Review Windows systems running Netty applications for any suspicious files in environment file locations
• Implement file system access controls to restrict write access to directories where Netty reads configuration files

Patch Information

The vulnerability has been addressed in commit d1fbda62d3a47835d3fb35db8bd42ecc205a5386. Organizations should update their Netty dependency to a version that includes this fix. Refer to the GitHub Security Advisory for the latest patched version information.

Additional vendor advisories are available from NetApp Security Advisory for affected NetApp products.

Workarounds

• Restrict file system permissions on Windows to prevent unauthorized users from creating files in Netty's environment file locations
• Implement application-level monitoring to detect and restart crashed Netty applications automatically
• Consider running Netty applications in containerized environments with restricted file system access

# Restrict permissions on environment file directories (Windows PowerShell example)
icacls "C:\path\to\netty\env" /inheritance:r /grant:r "SYSTEM:(OI)(CI)F" /grant:r "Administrators:(OI)(CI)F"