Improper Handling of Highly Compressed Data (Data Amplification) The advisory has been revoked - it doesn't affect any version of package kafka-3.8-fips (opens in a new tab)
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-MINIMOSLATEST-KAFKA38FIPS-16326302
- published1 May 2026
- disclosed4 Sept 2025
Introduced: 4 Sep 2025
CVE-2025-58057 (opens in a new tab)Amendment
The Minimos security team deemed this advisory irrelevant for Minimos:latest.
NVD Description
Note: Versions mentioned in the description apply only to the upstream kafka-3.8-fips package and not the kafka-3.8-fips package as distributed by Minimos.
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with specially crafted input, BrotliDecoder and certain other decompression decoders will allocate a large number of reachable byte buffers, which can lead to denial of service. BrotliDecoder.decompress has no limit in how often it calls pull, decompressing data 64K bytes at a time. The buffers are saved in the output list, and remain reachable until OOM is hit. This is fixed in versions 4.1.125.Final of netty-codec and 4.2.5.Final of netty-codec-compression.
References
- https://www.cve.org/CVERecord?id=CVE-2025-58057
- https://github.com/advisories/GHSA-3p8m-j85q-pgmj
- https://osv.dev/vulnerability/MINI-mq4j-mw7j-r822
- https://osv.dev/vulnerability/CVE-2025-58057
- https://github.com/netty/netty/commit/9d804c54ce962408ae6418255a83a13924f7145d
- https://github.com/netty/netty/security/advisories/GHSA-3p8m-j85q-pgmj