Resource exhaustion in Netty - CVE-2025-25193

Vulnerability identifier: #VU103769

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-25193

CWE-ID: CWE-400

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to application attempts to load a file that does not exist. A local user can create a large file on the system and crash the application.

Note, the vulnerability affects Windows installations only.

Netty
IBM DB2
Oracle Communications BRM - Elastic Charging Engine
Storage Protect for Virtual Environments: Data Protection for VMware
Netezza Appliance
IBM Application Suite - IBM Asset Data Dictionary Component
PowerVM NovaLink
Security QRadar EDR
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
Data Product Hub
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component
Db2 Big SQL
Oracle Business Intelligence Enterprise Edition
IBM Business Automation Manager Open Editions
Storage Protect for Space Management
Storage Protect Backup-Archive Client
Storage Protect for Virtual Environments: Data Protection for Hyper-V
Maximo Application Suite - Monitor Component
IBM OpenPages with Watson
Business Automation Insights
Event Processing
User Entity Behavior Analytics
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
watsonx Assistant Cartridge
Maximo Application Suite - IoT Component
IBM Event Endpoint Management
Guardium Data Protection
IBM Operator for Apache Flink
Log Analysis
Netcool Operations Insight
IBM Fusion HCI
IBM SPSS Analytic Server
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Sterling B2B Integrator
IBM Sterling Partner Engagement Manager
IBM Tivoli Netcool Impact
IBM Spectrum Symphony
IBM Cloud Application Performance Management (APM)
IBM SPSS Collaboration and Deployment Services
IBM Maximo Application Suite
IBM SPSS Modeler
IBM Robotic Process Automation
IBM Business Automation Workflow
IBM Observability with Instana
IBM Cloud Pak for Security
WebSphere eXtreme Scale
IBM Maximo Application Suite - Manage Component
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Enterprise Storage
SUSE Package Hub 15
Development Tools Module
openSUSE Leap
Voice Gateway
watsonx.data
IBM Sterling File Gateway
IBM Tivoli Application Dependency Discovery Manager
JBoss Enterprise Application Platform
AMQ Streams
IBM WebSphere Application Server Liberty
eap7-ironjacamar (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
eap7-wildfly-elytron (Red Hat package)
eap8-slf4j (Red Hat package)
netty-tcnative
netty-tcnative-javadoc
eap7-apache-commons-io (Red Hat package)
eap7-weld-core (Red Hat package)
eap7-hal-console (Red Hat package)
netty-javadoc
netty
eap8-netty-transport-native-epoll (Red Hat package)
eap8-netty (Red Hat package)
eap7-jboss-remoting (Red Hat package)
eap7-wildfly (Red Hat package)
eap8-wildfly (Red Hat package)
eap8-eap-product-conf-parent (Red Hat package)
Operational Decision Manager

Install updates from vendor's website.

Netty - update to 4.1.118
Storage Protect for Virtual Environments: Data Protection for VMware - update to 8.1.27.0
IBM Operator for Apache Flink - update to 1.4.5
Netezza Appliance - update to 1.0.0.1
Voice Gateway - update to 1.0.8.19
IBM Application Suite - IBM Asset Data Dictionary Component - update to 1.1.17
Netcool Operations Insight - update to 1.6.15
PowerVM NovaLink - addressed in versions 2.1.1-250528, 2.2.1.1-250529, 2.3.0.1-250610
watsonx.data - update to 2.2.1
IBM Fusion HCI - update to 2.10.0
Security QRadar EDR - update to 3.12.16
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 4.8.9, 5.2.1
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.2
Data Product Hub - update to 5.2.0
IBM Watson Knowledge Catalog in Cloud Pak for Data - update to 5.2
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component - update to 5.1.3
IBM Sterling File Gateway - addressed in versions 6.1.2.7.1, 6.2.0.5, 6.2.1.1
IBM Sterling B2B Integrator - addressed in versions 6.1.2.7.1, 6.2.0.5, 6.2.1.1
IBM Sterling Partner Engagement Manager - addressed in versions 6.2.3.5, 6.2.4.2
IBM Tivoli Netcool Impact - update to 7.1.0.37
IBM Spectrum Symphony - update to 7.3.2 FP3
JBoss Enterprise Application Platform - addressed in versions 7.4.21, 7.4.22, 8.0.6
Db2 Big SQL - update to 8.0
IBM Business Automation Manager Open Editions - update to 8.0.8
Storage Protect for Space Management - update to 8.1.27.0
Storage Protect Backup-Archive Client - update to 8.1.27
Storage Protect for Virtual Environments: Data Protection for Hyper-V - update to 8.1.27.0
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.4
IBM Maximo Application Suite - addressed in versions 8.10.29, 8.11.26, 9.0.15, 9.1.3
Maximo Application Suite - Monitor Component - addressed in versions 8.10.19, 8.11.17, 9.0.9, 9.1.0
IBM Robotic Process Automation - addressed in versions 21.0.7.21, 23.0.20.2
IBM Business Automation Workflow - addressed in versions 24.0.0-IF006, 24.0.1-IF001
Business Automation Insights - addressed in versions 24.0.0.0.4, 24.0.1.0.4
IBM Observability with Instana - update to 291
Event Processing - update to 1.4.1
eap7-ironjacamar (Red Hat package) - addressed in versions 1.5.19-1.Final_redhat_00001.1.el7eap, 1.5.19-1.Final_redhat_00001.1.el8eap, 1.5.19-1.Final_redhat_00001.1.el9eap
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-41.Final_redhat_00041.1.el7eap, 1.10.0-41.Final_redhat_00041.1.el8eap, 1.10.0-41.Final_redhat_00041.1.el9eap
IBM Cloud Pak for Security - update to 1.11.2.0
eap7-wildfly-elytron (Red Hat package) - addressed in versions 1.15.25-1.Final_redhat_00001.1.el7eap, 1.15.25-1.Final_redhat_00001.1.el8eap, 1.15.25-1.Final_redhat_00001.1.el9eap
AMQ Streams - update to 2
eap8-slf4j (Red Hat package) - addressed in versions 2.0.16-2.redhat_00003.1.el8eap, 2.0.16-2.redhat_00003.1.el9eap
netty-tcnative - update to 2.0.70-150200.3.25.1
netty-tcnative-javadoc - update to 2.0.70-150200.3.25.1
eap7-apache-commons-io (Red Hat package) - addressed in versions 2.16.1-1.redhat_00001.1.el7eap, 2.16.1-1.redhat_00001.1.el8eap, 2.16.1-1.redhat_00001.1.el9eap
eap7-weld-core (Red Hat package) - addressed in versions 3.1.11-1.Final_redhat_00001.1.el7eap, 3.1.11-1.Final_redhat_00001.1.el8eap, 3.1.11-1.Final_redhat_00001.1.el9eap
eap7-hal-console (Red Hat package) - addressed in versions 3.3.26-1.Final_redhat_00001.1.el7eap, 3.3.26-1.Final_redhat_00001.1.el8eap, 3.3.26-1.Final_redhat_00001.1.el9eap
netty-javadoc - update to 4.1.118-150200.4.29.2
netty - update to 4.1.118-150200.4.29.2
eap8-netty-transport-native-epoll (Red Hat package) - addressed in versions 4.1.119-1.Final_redhat_00002.1.el8eap, 4.1.119-1.Final_redhat_00002.1.el9eap
eap8-netty (Red Hat package) - addressed in versions 4.1.119-1.Final_redhat_00002.1.el8eap, 4.1.119-1.Final_redhat_00002.1.el9eap
User Entity Behavior Analytics - update to 5.0.2
eap7-jboss-remoting (Red Hat package) - addressed in versions 5.0.31-1.Final_redhat_00001.1.el7eap, 5.0.31-1.Final_redhat_00001.1.el8eap, 5.0.31-1.Final_redhat_00001.1.el9eap
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.3.0
watsonx Assistant Cartridge - update to 5.3.0
eap7-wildfly (Red Hat package) - addressed in versions 7.4.22-2.GA_redhat_00001.1.el7eap, 7.4.22-2.GA_redhat_00001.1.el8eap, 7.4.22-2.GA_redhat_00001.1.el9eap
eap8-wildfly (Red Hat package) - addressed in versions 8.0.6-15.GA_redhat_00009.1.el8eap, 8.0.6-15.GA_redhat_00009.1.el9eap
WebSphere eXtreme Scale - update to 8.6.1.6 PH68446
IBM Maximo Application Suite - Manage Component - addressed in versions 8.6.26, 8.7.20, 9.0.13
Maximo Application Suite - IoT Component - addressed in versions 8.7.21, 8.8.17, 9.0.7
Operational Decision Manager - addressed in versions 8.11.0.1 Interim fix 42, 8.11.1.0 Interim fix 39, 8.12.0.1 Interim fix 24, 9.0.0.1 Interim fix 7
IBM Event Endpoint Management - update to 11.4.2
Guardium Data Protection - update to 12.0p40
IBM WebSphere Application Server Liberty - update to 25.0.0.4
eap8-eap-product-conf-parent (Red Hat package) - addressed in versions 800.6.1-1.GA_redhat_00001.1.el8eap, 800.6.1-1.GA_redhat_00001.1.el9eap

• https://github.com/netty/netty/commit/d1fbda62d3a47835d3fb35db8bd42ecc205a5386
• https://github.com/netty/netty/security/advisories/GHSA-389x-839f-4rhx

• Multiple vulnerabilities in Netty
• SUSE update for netty, netty-tcnative
• Multiple vulnerabilities in IBM Event Endpoint Management
• Multiple vulnerabilities in IBM Security QRadar EDR
• Multiple vulnerabilities in IBM Observability with Instana
• IBM WebSphere Application Server Liberty update for Netty
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 8.0
• Multiple vulnerabilities in IBM Voice Gateway
• IBM Maximo Application Suite - IoT Component update for Netty
• Multiple vulnerabilities in IBM Cloud Pak for Security
• Multiple vulnerabilities in IBM Operational Decision Manager
• Multiple vulnerabilities in IBM Db2
• Multiple vulnerabilities in IBM SPSS Collaboration and Deployment Services
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 7
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4
• IBM Maximo Application Suite - Monitor Component update for Netty
• Multiple vulnerabilities in IBM Maximo Application Suite - Manage Component
• Multiple vulnerabilities in IBM Log Analysis
• Multiple vulnerabilities in IBM Tivoli Application Dependency Discovery Manager
• Multiple vulnerabilities in IBM Guardium Data Protection
• Multiple vulnerabilities in IBM SPSS Analytic Server
• IBM Asset Data Dictionary Component update for Netty
• Multiple vulnerabilities in IBM Fusion
• Multiple vulnerabilities in IBM Data Product Hub
• IBM Robotic Process Automation for Cloud Pak update for Netty
• Multiple vulnerabilities in IBM PowerVM Novalink
• Multiple vulnerabilities in IBM Storage Protect Backup-Archive Client
• Multiple vulnerabilities in IBM Storage Protect for Space Management
• Multiple vulnerabilities in IBM Storage Protect for Virtual Environments (Data Protection for VMware and Data Protection for Hyper-V)
• Multiple vulnerabilities in AMQ Streams
• Multiple vulnerabilities in IBM Event Processing
• IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data update for Netty
• Multiple vulnerabilities in IBM DB2 bundled with IBM Application Performance Management products
• Multiple vulnerabilities in IBM OpenPages
• Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component
• Multiple vulnerabilities in IBM Business Automation Workflow
• Multiple vulnerabilities in IBM Business Automation Insights
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Multiple vulnerabilities in IBM Sterling B2B Integrator and IBM Sterling File Gateway
• IBM Watson Discovery update for Netty
• IBM watsonx.data update for Netty
• Multiple vulnerabilities in IBM Maximo Application Suite
• Multiple vulnerabilities in IBM WebSphere Extreme Scale
• Multiple vulnerabilities in IBM User Entity Behavior Analytics
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• Multiple vulnerabilities in IBM Spectrum Symphony
• Multiple vulnerabilities in IBM Tivoli Netcool Impact
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in IBM Sterling Partner Engagement Manager Essentials Edition
• Multiple vulnerabilities in IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge
• Multiple vulnerabilities in Oracle Communications BRM - Elastic Charging Engine
• Multiple vulnerabilities in IBM Big SQL on IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Operator for Apache Flink
• Multiple vulnerabilities in IBM Netezza Appliance
• Multiple vulnerabilities in IBM Watson Knowledge Catalog on-prem
• Multiple vulnerabilities in IBM SPSS Modeler