IT48630: IBM STORAGE INSIGHTS SECURITY APAR FOR CVE-2025-58057, CVE-2025-58056, CVE-2025-55163

APAR status

• Closed as program error.

Error description

• CVEID: CVE-2025-58057
  Description: Netty is an asynchronous event-driven network
  application framework for rapid development of maintainable high
  performance protocol servers & clients. In
  netty-codec-compression versions 4.1.124.Final and below, and
  netty-codec versions 4.2.4.Final and below, when supplied with
  specially crafted input, BrotliDecoder and certain other
  decompression decoders will allocate a large number of reachable
  byte buffers, which can lead to denial of service.
  BrotliDecoder.decompress has no limit in how often it calls
  pull, decompressing data 64K bytes at a time. The buffers are
  saved in the output list, and remain reachable until OOM is hit.
  This is fixed in versions 4.1.125.Final of netty-codec and
  4.2.5.Final of netty-codec-compression.
  
  CVEID: CVE-2025-58056
  Description: Netty is an asynchronous event-driven network
  application framework for development of maintainable high
  performance protocol servers and clients. In versions
  4.1.124.Final, and 4.2.0.Alpha3 through 4.2.4.Final, Netty
  incorrectly accepts standalone newline characters (LF) as a
  chunk-size line terminator, regardless of a preceding carriage
  return (CR), instead of requiring CRLF per HTTP/1.1 standards.
  When combined with reverse proxies that parse LF differently
  (treating it as part of the chunk extension), attackers can
  craft requests that the proxy sees as one request but Netty
  processes as two, enabling request smuggling attacks. This is
  fixed in versions 4.1.125.Final and 4.2.5.Final.
  
  CVEID: CVE-2025-55163
  Description: Netty is an asynchronous, event-driven network
  application framework. Prior to versions 4.1.124.Final and
  4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a
  logical vulnerability in the HTTP/2 protocol, that uses
  malformed HTTP/2 control frames in order to break the max
  concurrent streams limit - which results in resource exhaustion
  and distributed denial of service. This issue has been patched
  in versions 4.1.124.Final and 4.2.4.Final.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * IBM Storage Insights users                                   *
  *                                                              *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * SECURITY APAR FOR:                                           *
  * CVE-2025-58057, CVE-2025-58056,                              *
  * CVE-2025-55163                                               *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  

Problem conclusion

• SECURITY APAR FOR:
  CVE-2025-58057, CVE-2025-58056,
  CVE-2025-55163
  
  
  See security bulletin for details:
  xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
  
  The fix for this APAR is contained in the following release:
  
  IBM Storage Insights 4Q25   [ 54X-IBM-SI ]
  ( release target 4Q 2025 / November )
  
  To protect IBM Storage Insights against emerging
  security vulnerabilities, the service was updated to
  protected against vulnerabilities.
  
  An upgrade of your IBM Storage Insights Data Collector(s)
  will apply this fix.
  
  If you do not have automatic upgrade enabled, please
  upgrade your Data Collector(s) manually to apply the fix.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  STORAGE INSIGHT

• Fixed component ID

  5608TPCSI

Applicable component levels