What’s Vulnerable › Vulnerabilities

CVE-2025-55163: Netty MadeYouReset HTTP/2 DDoS Vulnerability

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-08-13 · updated 2026-06-17
• Weakness: CWE-770

Description

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service. This issue has been patched in versions 4.1.124.Final and 4.2.4.Final.

Affected products

• netty: before 4.1.124; from 4.2.0 before 4.2.4 — fixed in 4.1.124, 4.2.4

How to fix

Upgrade to a fixed version: netty 4.1.124, 4.2.4. Check the vendor advisory for mitigations.

References

• https://github.com/netty/netty/security/advisories/GHSA-prj3-ccx8-p6x4
• http://www.openwall.com/lists/oss-security/2025/08/16/1
• https://www.kb.cert.org/vuls/id/767506

Get alerted when CVE-2025-55163 or the next vulnerability affects your stack