CVE-2025-55163

Name	CVE-2025-55163
Description	Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service. This issue has been patched in versions 4.1.124.Final and 4.2.4.Final.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1111105

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
netty (PTS)	bullseye (security), bullseye	1:4.1.48-4+deb11u2	vulnerable
	bookworm, bookworm (security)	1:4.1.48-7+deb12u1	vulnerable
	trixie	1:4.1.48-10	vulnerable
	forky, sid	1:4.1.48-12	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
netty	source	(unstable)	1:4.1.48-11			1111105

Notes

https://github.com/netty/netty/security/advisories/GHSA-prj3-ccx8-p6x4
Fixed by [1/2]: https://github.com/netty/netty/commit/be53dc3c9acd9af2e20d0c3c07cd77115a594cf1 (netty-4.1.124.Final)
Fixed by [2/2]: https://github.com/netty/netty/commit/009bd17b38a39fb1eecf9d22ea8ae8108afaac59 (netty-4.1.124.Final)