| Name | CVE-2025-55163 |
| Description | Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service. This issue has been patched in versions 4.1.124.Final and 4.2.4.Final. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DSA-6160-1 |
| Debian Bugs | 1111105 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| netty (PTS) | bullseye (security), bullseye | 1:4.1.48-4+deb11u2 | vulnerable |
| bookworm | 1:4.1.48-7+deb12u1 | vulnerable | |
| bookworm (security) | 1:4.1.48-7+deb12u2 | fixed | |
| trixie | 1:4.1.48-10 | vulnerable | |
| trixie (security) | 1:4.1.48-10+deb13u1 | fixed | |
| forky, sid | 1:4.1.48-16 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| netty | source | bookworm | 1:4.1.48-7+deb12u2 | DSA-6160-1 | ||
| netty | source | trixie | 1:4.1.48-10+deb13u1 | DSA-6160-1 | ||
| netty | source | (unstable) | 1:4.1.48-11 | 1111105 |
https://github.com/netty/netty/security/advisories/GHSA-prj3-ccx8-p6x4
Fixed by [1/2]: https://github.com/netty/netty/commit/be53dc3c9acd9af2e20d0c3c07cd77115a594cf1 (netty-4.1.124.Final)
Fixed by [2/2]: https://github.com/netty/netty/commit/009bd17b38a39fb1eecf9d22ea8ae8108afaac59 (netty-4.1.124.Final)