Vulnerability · Published Aug 13, 2025 · Assigned by GitHub_M
CVE-2025-55163Netty MadeYouReset HTTP/2 DDoS Vulnerability
High 8.2
In plain English
A high-severity resource allocation without limits in netty from netty. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service. This issue has been patched in versions 4.1.124.Final and 4.2.4.Final.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | netty | 1:4.1.48-7+deb12u2 | DSA-6160-1 |
| Debian:12 | netty | 1:4.1.48-7+deb12u2 | DEBIAN-CVE-2025-55163 |
| Debian:13 | netty | 1:4.1.48-10+deb13u1 | DSA-6160-1 |
| Debian:13 | netty | 1:4.1.48-10+deb13u1 | DEBIAN-CVE-2025-55163 |
| Debian:14 | netty | 1:4.1.48-11 | DEBIAN-CVE-2025-55163 |
| Maven | io.grpc:grpc-netty-shaded | 1.75.0 | GHSA-prj3-ccx8-p6x4 |
| Maven | io.netty:netty-codec-http2 | 4.1.124.Final | GHSA-prj3-ccx8-p6x4 |
| Maven | io.netty:netty-codec-http2 | 4.2.4.Final | GHSA-prj3-ccx8-p6x4 |
| Ubuntu:22.04:LTS | netty | 1:4.1.48-4+deb11u2ubuntu0.2 | UBUNTU-CVE-2025-55163 |
| Ubuntu:22.04:LTS | netty | 1:4.1.48-4+deb11u2ubuntu0.2 | USN-8654-1 |
| Ubuntu:24.04:LTS | netty | 1:4.1.48-9ubuntu0.2 | USN-8654-1 |
| Ubuntu:24.04:LTS | netty | 1:4.1.48-9ubuntu0.2 | UBUNTU-CVE-2025-55163 |
| Ubuntu:25.10 | netty | no fix listed | UBUNTU-CVE-2025-55163 |
| Ubuntu:26.10 | netty | no fix listed | UBUNTU-CVE-2025-55163 |
Affected products (as reported)
Weakness: CWE-770 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N