CVE-2025-55163

Name	CVE-2025-55163
Description	Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service. This issue has been patched in versions 4.1.124.Final and 4.2.4.Final.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1111105

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
netty (PTS)	bullseye (security), bullseye	1:4.1.48-4+deb11u2	vulnerable
	bookworm, bookworm (security)	1:4.1.48-7+deb12u1	vulnerable
	forky, sid, trixie	1:4.1.48-10	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
netty	source	(unstable)	(unfixed)			1111105

https://github.com/netty/netty/security/advisories/GHSA-prj3-ccx8-p6x4