CVE-2025-55163
Aliases:GHSA-prj3-ccx8-p6x4DEBIAN-CVE-2025-55163UBUNTU-CVE-2025-55163CGA-22g2-pjc9-fc44CGA-2436-c8g5-69m3CGA-2fr8-cjgf-cqv6CGA-2jp6-8q95-qx46CGA-2qjr-jgxp-27pxCGA-2x5f-3vjc-5fhjCGA-2xmp-9hmh-78vxCGA-2xqh-6rm4-qpwjCGA-2xr8-9pcm-h89qCGA-334r-wmm8-78jqCGA-356c-m5cw-rwgfCGA-37w2-m43v-f247CGA-39xg-q34m-mv97CGA-3c73-9p5r-4w34CGA-3fpj-5pwx-2f8jCGA-3qq9-494r-h7xqCGA-3r4f-6qc8-v9hgCGA-3r9p-4mf3-p2hmCGA-3v8q-48cf-j4qfCGA-3wp9-8qfh-pw67CGA-44j5-5hph-r8h4CGA-4534-74fx-vrqgCGA-467m-36xq-7qf4CGA-49hx-64mj-wr3wCGA-4mm4-rmcc-whh6CGA-4mv7-4vx4-8hpxCGA-4pr7-rpqh-w9m6CGA-4v23-76r5-w5v7CGA-4vvx-fwmc-h7jmCGA-52fv-cx55-m3mrCGA-558p-4725-97v7CGA-56cc-6p9m-jw4jCGA-59pp-7fc3-h276CGA-5cm9-4997-pqrxCGA-5f83-h9gm-8vcmCGA-5jfr-rjv4-r57cCGA-5p5g-qrq8-p3h9CGA-5q5w-54j4-rjh4CGA-5qcg-79pw-7qvmCGA-5r2c-v49j-qjhvCGA-5w6h-6jqh-g7f4CGA-5wg8-8c9v-h85fCGA-632h-7vqp-6q4mCGA-66c4-3g86-6xhrCGA-66mp-c3qm-ggwxCGA-67rp-45rw-49gjCGA-6cq6-r4q9-rg44CGA-6cr4-8jjh-mg99CGA-6cxc-g7r3-3xj2CGA-6fx9-94rw-3qfwCGA-6jvm-wmx2-6rp5CGA-6m28-c9hr-289vCGA-6rg7-7g4c-jx6qCGA-6vcm-92hh-wmj6CGA-6wv9-fh69-mr5rCGA-798h-h99x-x88xCGA-7g7v-9p89-7xxqCGA-7g89-qfpw-hr3vCGA-7gjg-9jmr-2w79CGA-7jr2-x37v-qwc9CGA-7mq6-wjhq-c939CGA-7pc4-jfp8-w4j8CGA-7xgp-8hrc-9frqCGA-82vw-64r2-jv62CGA-85c7-crf2-jr72CGA-87qx-477r-wvjrCGA-88qx-ff98-ppmfCGA-8c9w-34r4-pjj8CGA-8h5h-xxgc-2gm9CGA-8jhq-86qx-2wfvCGA-8jr8-78x2-jvr3CGA-8pv9-93w2-c6g3CGA-8r38-cmw2-95q8CGA-8w82-7rv5-6xj9CGA-8wx6-v57x-j4qrCGA-929g-x5r2-fqc7CGA-935w-pwp4-c4r6CGA-966m-m5q7-g5q6CGA-96w8-4wvq-pjc7CGA-97qj-mmrf-gp58CGA-9892-7g2r-8p52CGA-9c44-2ggc-2995CGA-9gx5-5782-xfgxCGA-9j4x-375f-5x8qCGA-9m5f-7pp5-5fcrCGA-9mh9-3p59-fgpvCGA-9mrm-j6wx-p33jCGA-9xxg-qhgr-fpg6CGA-c27p-9rj7-pjx5CGA-c5qv-fppx-xv67CGA-c7v3-fv7v-5pg2CGA-c86c-jxvh-37xqCGA-c89h-wm5r-h65xCGA-cg8x-gfwm-25xwCGA-cgp4-cgw3-6rrgCGA-cgr2-34p4-c8xjCGA-cjfc-7vg5-j5rxCGA-cjg7-89cp-hrc4CGA-cw58-c3jr-g73qCGA-f32x-98cq-m68fCGA-f4v7-ffwp-vcc2CGA-fc89-vff9-736pCGA-ffjc-gp83-v5v6CGA-fqjq-j2vq-cc3jCGA-fqrj-x6ff-mxq3CGA-frqx-9vxr-7rxqCGA-fvrh-58fc-vw4qCGA-g8q6-4hv5-r8j2CGA-gg6j-mjcf-rr59CGA-ggq2-g6x9-j6g5CGA-ghxh-53wp-wq8rCGA-gjxg-79wg-fw9rCGA-gr7g-jhhg-75jfCGA-gv45-vvxh-69jfCGA-gv93-5xr7-rgfpCGA-gvhr-r9fq-5c58CGA-gwr3-8446-qp54CGA-gxx7-2qcm-pm6jCGA-h858-vh6h-25pjCGA-h8vq-frfg-p6vhCGA-hf83-9235-9jp9CGA-hg65-cr7f-396mCGA-hm68-8qq7-cjc3CGA-hq3f-66cw-qf58CGA-hrx9-4fh7-fcm5CGA-hv67-hccj-5648CGA-hvxm-hpf4-xxv5CGA-hx7h-2jrx-2vvfCGA-hx84-rxj9-h337CGA-hxwf-gwrg-ghj6CGA-j248-rgpq-f2p4CGA-j3wm-gv24-7g7fCGA-j7rj-vr45-h367CGA-jcfg-qhjr-2qpqCGA-jf37-768h-wwwhCGA-jfg9-mm2h-9659CGA-jgr8-95p5-24m8CGA-jmqx-jjc9-6v3pCGA-jq53-jj5j-j273CGA-jq63-vqqc-c5xwCGA-jrch-52c8-rq2qCGA-jvc7-p269-xjfwCGA-jwmf-225v-fv38CGA-jxxg-mr9m-g4pcCGA-m27v-8r3x-v2fjCGA-m8xh-639p-mm22CGA-mf5m-r8gc-rcjhCGA-mfx5-4vj5-mw7hCGA-mhh6-r7vx-p7q3CGA-mj5p-v6gc-hvq7CGA-mmj3-xp7x-3jr4CGA-mv3j-wpgf-4ghcCGA-mv7x-q4xx-9wxgCGA-mx47-7pf8-34q9CGA-mxxg-fpv6-fp44CGA-p4fx-c26w-9p39CGA-p83p-c3r8-w9w4CGA-p8wv-jjcj-hxjfCGA-p9wf-pvr9-4x5wCGA-pfhx-9pjm-7gf8CGA-ph55-9c6p-g59fCGA-pjp5-fhpm-pxcjCGA-pp78-g6rr-27w3CGA-22qp-w95r-h729CGA-277h-xhrw-xq3gCGA-2chw-hx3x-h493CGA-2w9c-9cjp-898mCGA-2x8w-fp38-jf47CGA-3654-p867-wj8mCGA-3fpp-rr93-fmw8CGA-3fw4-pwwj-3gr9CGA-3gw4-v575-q5vpCGA-3r59-7pff-84j5CGA-3rhx-vwq9-pw25CGA-3w2r-298x-jvxfCGA-42c9-5p5h-3rhgCGA-43xx-2mgf-r8q6CGA-4q9v-c6v3-mwmjCGA-4w8c-hwm4-qm2hCGA-4x4p-r4jw-h4f8CGA-58jh-2499-8hcxCGA-5q5g-m8w9-4fr3CGA-5vwr-p8gm-p3wwCGA-5x5m-729f-gmf6CGA-62x6-8c8x-862vCGA-66c4-fm57-jmx9CGA-6cph-vhf6-779cCGA-6f23-j9fp-jq4qCGA-6f5c-wvr4-99whCGA-6hjm-crq9-836pCGA-6vfx-2g2h-423fCGA-6vx8-7835-58fvCGA-7973-r9r9-qvr8CGA-79jf-8h5j-xw83CGA-7fmr-895v-hfh8CGA-7grh-6v9f-39m4CGA-7h4j-xg3w-9c8vCGA-7mh8-grfp-256rCGA-8gpr-wcqh-xj27CGA-8rvc-h879-rh3rCGA-8vp9-3q4w-v6c5CGA-9275-vmvr-p69fCGA-92vr-2255-pm2rCGA-945x-2q7c-g93rCGA-9829-w3qw-65w5CGA-9mjq-r8w5-fv5fCGA-9xgv-cg4p-m23pCGA-c4pp-h757-gc58CGA-c4v5-xp2c-g6wcCGA-c7h2-7wj8-h4q8CGA-cgvh-43cf-95rpCGA-cm72-j4xr-3qvpCGA-cmc7-fqvq-7v73CGA-f39r-3vqq-286fCGA-f5fh-jjpg-59g9CGA-f5m6-frqc-f2prCGA-f6h7-p3wm-wxmmCGA-f6vw-m239-3mc2CGA-ff5m-2864-mcq3CGA-fg6x-mgf5-5994CGA-fhh9-5g2m-8fhpCGA-fq79-95cc-2g5wCGA-g8r7-ghw9-p67vCGA-gm8r-76p7-j9w4CGA-gmpr-9853-88rqCGA-gx62-jq93-5xv7CGA-h25m-pw7h-x6qxCGA-h2g2-j655-g3hcCGA-h386-vqg3-fhgvCGA-hc7h-f62f-5gfcCGA-hmr2-8r3r-mjfxCGA-hmvf-3xcr-r754CGA-hw73-4c99-pgc2CGA-hwg8-9gmm-rrpmCGA-hx6x-c9w9-xrc9CGA-j899-3xv6-ppmhCGA-jpj5-63g8-47p6CGA-jqph-jcw4-qh6qCGA-m3c6-mqq8-wpgmCGA-m593-qj74-mxc9CGA-m7g8-2288-g8jwCGA-mcg3-2p6c-7c96CGA-mg47-rvgq-8893CGA-mp99-j465-2rfcCGA-mrqq-mjhx-827pCGA-p482-xw5r-pc3gCGA-p6pp-ppm5-jm2xCGA-pc3h-fcxf-rfrgCGA-pcm8-j2q5-c2jxCGA-ph24-cm65-85w2CGA-pvrm-p6j7-25pjCGA-q48p-f3j2-964jCGA-q4j6-885v-p7fgCGA-q59v-3xm6-gv7qCGA-q5qc-jgjq-r54hCGA-q72p-p73m-7wjqCGA-q7j3-353m-r5ggCGA-q7vg-hqxh-qg88CGA-q866-vch5-r6p7CGA-q8x3-7vqf-683jCGA-qh4w-mm96-jwx9CGA-qh5r-vx2c-4pw5CGA-qhch-jc6g-22qjCGA-qmfp-xwcp-qvpvCGA-qmw4-628v-3398CGA-qq46-wmvx-cvjfCGA-qrfc-j92v-p4mfCGA-qv9g-cpgf-cv4hCGA-r39x-984q-q5gfCGA-r44g-wvg9-v5p4CGA-r44h-p57p-vqr3CGA-r62x-fh59-4c23CGA-r97h-2h93-3jj4CGA-r9jp-4jfw-vxp3CGA-rfx7-xw6q-g23fCGA-rg7j-7c97-g7p4CGA-rgp2-p7rh-qqrfCGA-rh33-4jgp-x65vCGA-rm6j-v8p8-w6fpCGA-rpwx-8vh8-8g74CGA-rr72-gcch-7p82CGA-rx32-5688-xqcmCGA-rxgw-hq55-333wCGA-v393-634f-hvrrCGA-v473-wxhh-6j33CGA-v58m-968v-f384CGA-v5mp-6cfh-4pw4CGA-v82c-m6vr-38fxCGA-v8rw-m3ph-wm6cCGA-v9m8-whr2-qxrhCGA-vcwh-835h-pqrhCGA-vffh-qmvg-jr5hCGA-vhm8-pwpj-8wffCGA-vhmp-r2rg-q7c5CGA-vj5m-38rj-3gfcCGA-vv36-hgmh-3jpcCGA-vwg6-rj42-q6c2CGA-vxc3-7xp7-w69xCGA-w2hj-6xqw-hvgmCGA-w3v8-w67c-j7x5CGA-w5vx-26jv-v9xhCGA-w677-j8jh-28jfCGA-w6mq-69c8-5mfcCGA-w6mx-p5rc-ccqgCGA-w6wc-j35g-8ch7CGA-w853-mmf3-r26mCGA-w8wf-h9fm-382vCGA-wh5c-2j5h-grqfCGA-whw4-9hxv-xrh5CGA-wm2h-r386-h52wCGA-wp6q-hvrj-rj4cCGA-wrw3-4mqf-q552CGA-wwcm-ccgr-242vCGA-wx9p-r8xh-hfchCGA-x2c5-qmg7-fv96CGA-x2ph-7f2c-qp64CGA-x3rh-5432-cgp3CGA-x59f-634g-vw97CGA-xfmw-xq35-mm3hCGA-xh52-m4rv-5wrqCGA-xj8r-3pxc-pq75CGA-xjx2-vpp6-jq8gCGA-xmg8-fhfm-qjg2CGA-xpfh-h4jr-75fvCGA-xxf9-qpcm-58r6
Advisory lineage Upstream: 0 Downstream: 15
Modified
Published: 13 Aug 2025, 14:17
Last modified:04 Nov 2025, 21:13
Vulnerability Summary
Overall Risk (default)
medium
43/100 CVSS Score
8.2 HIGH
v4.0 (cve.org)
EPSS Score
1.05% LOW
1% probability +0.93%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected
Timeline
13 Aug 2025, 14:17
Published
Vulnerability first disclosed
04 Nov 2025, 21:13
Last Modified
Vulnerability information updated
Description
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service. This issue has been patched in versions 4.1.124.Final and 4.2.4.Final.
CVSS Metrics
- v4.0•HIGH•Score: 8.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- v4.0•HIGH•Score: 8.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Trends
Current EPSS score: 1.05%• Percentile: 63%
Techniques & Countermeasures
- CWE-770•Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Affected Systems
- chainguard•akhq
< 0.26.0-r3
- chainguard•apache-hop
< 2.15.0-r1
- chainguard•apache-hop-fips
< 2.15.0-r1
- chainguard•apache-nifi
< 2.5.0-r3
- chainguard•apache-nifi-compat
< 2.5.0-r3
- chainguard•apache-nifi-toolkit
< 2.5.0-r3
- chainguard•apache-pulsar
< 4.0.6-r1
- chainguard•apache-pulsar-compat
< 4.0.6-r1
- chainguard•apicurio-registry
< 3.0.12-r1
- chainguard•apicurio-registry-nginx-config
< 3.0.12-r1
- chainguard•apicurio-registry-ui
< 3.0.12-r1
- chainguard•camunda-zeebe-8.6
< 8.6.24-r1
- chainguard•camunda-zeebe-8.6-compat
< 8.6.24-r1
- chainguard•camunda-zeebe-8.7
< 8.7.10-r1
- chainguard•camunda-zeebe-8.7-compat
< 8.7.10-r1
- chainguard•celeborn-0.5
< 0.5.4-r26 | all
- chainguard•celeborn-0.6
< 0.6.3-r7
- chainguard•commercial-elasticsearch-8.17
all
- chainguard•docker-selenium-standalone-chrome
all
- chainguard•druid
< 34.0.0-r1
- chainguard•druid-compat
< 34.0.0-r1
- chainguard•elasticsearch-8.19
< 8.19.2-r12
- chainguard•elasticsearch-8.19-config
< 8.19.2-r12
- chainguard•elasticsearch-8.19-iamguarded
< 8.19.2-r12
- chainguard•elasticsearch-9.0
< 9.0.7-r0
- chainguard•elasticsearch-9.0-config
< 9.0.7-r0
- chainguard•elasticsearch-9.0-iamguarded
< 9.0.7-r0
- chainguard•elasticsearch-fips-9.0
< 9.0.8-r0
- chainguard•elasticsearch-fips-9.0-bitnami
< 9.0.8-r0
- chainguard•elasticsearch-fips-9.0-config
< 9.0.8-r0
- chainguard•elasticsearch-fips-9.1
< 9.1.3-r0
- chainguard•elasticsearch-fips-9.1-config
< 9.1.3-r0
- chainguard•flyway
< 11.11.0-r1
- chainguard•grpc-java-fips-1.56.0-m2
< 1.56.0-r6
- chainguard•hadoop-fips-3.3.6
< 3.3.6-r3
- chainguard•hadoop-fips-3.4.2
all
- chainguard•hadoop-fips-3.5
all | < 3.5.0-r12
- chainguard•infinispan-15.1
< 15.1.7-r1
- chainguard•infinispan-15.1-compat
< 15.1.7-r1
- chainguard•infinispan-15.1-images
< 15.1.7-r1
- chainguard•infinispan-15.2
< 15.2.5-r1
- chainguard•infinispan-15.2-compat
< 15.2.5-r1
- chainguard•infinispan-15.2-images
< 15.2.5-r1
- chainguard•kafka_exporter-strimzi-compat
< 0.47.0-r3
- chainguard•kafka-strimzi-compat
< 0.47.0-r3
- chainguard•keycloak
< 26.3.2-r2
- chainguard•keycloak-26.2
< 26.2.5-r1
- chainguard•keycloak-26.2-compat
< 26.2.5-r1
- chainguard•keycloak-26.2-iamguarded-compat
< 26.2.5-r1
- chainguard•knative-kafka-broker-1.17-dispatcher-loom
< 1.17.3-r5
Showing first 50 affected entries in server-rendered view.
References (12)
- https://github.com/netty/netty/security/advisories/GHSA-prj3-ccx8-p6x4
- https://www.kb.cert.org/vuls/id/767506
- http://www.openwall.com/lists/oss-security/2025/08/16/1
- https://nvd.nist.gov/vuln/detail/CVE-2025-55163
- https://github.com/grpc/grpc-java/commit/6462ef9a11980e168c21d90bbc7245c728fd1a7a
- https://github.com/netty/netty/commit/be53dc3c9acd9af2e20d0c3c07cd77115a594cf1
- https://github.com/netty/netty
- https://security-tracker.debian.org/tracker/CVE-2025-55163
- https://ubuntu.com/security/CVE-2025-55163
- https://www.cve.org/CVERecord?id=CVE-2025-55163
- https://ubuntu.com/security/notices/USN-8654-1
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55163.json