CVE-2025-55163: Netty MadeYouReset HTTP/2 DDoS Vulnerability

Modified

AliasesSUSE-SU-2025:03021-1UBUNTU-CVE-2025-55163DEBIAN-CVE-2025-55163+327 more

Published 13-08-2025Last modified 04-11-2025

Vulnerability summary

CVE-2025-55163 is a high (CVSS 8.2) vulnerability in netty. EPSS estimates a 1.13% chance of exploitation in the next 30 days, higher than 66.3% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Prioritisepublic exploit

Public exploit (GitHub, Date unknown)

Source freshness unavailable

How is this decided?

CVSS score

8.2/10

010

High · v4.0 (CVE.org)

EPSS score

1.13%

0%100%

Low · +0.02 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1github

Timeline

13-08-2025
PublishedVulnerability first disclosed.
04-11-2025
Last modifiedVulnerability information updated.

Description

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service. This issue has been patched in versions 4.1.124.Final and 4.2.4.Final.

CVSS metrics

10 scores · 7 sources · 2 versions

v4.08.2v3.17.5

EPSS trend

Probability

1.13%

Chance of exploitation in the next 30 days

Percentile

66%

Versus all other CVEs

30-day change

Increase +0.02 pp

From 1.10% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

githubUnverified
Netty
Maturity: poc

Weaknesses

CWE · root cause

CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard155 products

akhq< 0.26.0-r3
apache-hop< 2.15.0-r1
apache-hop-fips< 2.15.0-r1
apache-nifi< 2.5.0-r3
apache-nifi-compat< 2.5.0-r3

apache-nifi-toolkit< 2.5.0-r3
apache-pulsar< 4.0.6-r1
apache-pulsar-compat< 4.0.6-r1
apicurio-registry< 3.0.12-r1
apicurio-registry-nginx-config< 3.0.12-r1
apicurio-registry-ui< 3.0.12-r1
camunda-zeebe-8.6< 8.6.24-r1
camunda-zeebe-8.6-compat< 8.6.24-r1
camunda-zeebe-8.7< 8.7.10-r1
camunda-zeebe-8.7-compat< 8.7.10-r1
celeborn-0.5< 0.5.4-r26 | All versions (No fix recorded)
celeborn-0.6< 0.6.3-r7
commercial-elasticsearch-8.17All versions (No fix recorded)
docker-selenium-standalone-chromeAll versions (No fix recorded)
druid< 34.0.0-r1
druid-compat< 34.0.0-r1
elasticsearch-8.19< 8.19.2-r12
elasticsearch-8.19-config< 8.19.2-r12
elasticsearch-8.19-iamguarded< 8.19.2-r12
elasticsearch-9.0< 9.0.7-r0
elasticsearch-9.0-config< 9.0.7-r0
elasticsearch-9.0-iamguarded< 9.0.7-r0
elasticsearch-fips-9.0< 9.0.8-r0
elasticsearch-fips-9.0-bitnami< 9.0.8-r0
elasticsearch-fips-9.0-config< 9.0.8-r0
elasticsearch-fips-9.1< 9.1.3-r0
elasticsearch-fips-9.1-config< 9.1.3-r0
flyway< 11.11.0-r1
grpc-java-fips-1.56.0-m2< 1.56.0-r6
hadoop-fips-3.3.6< 3.3.6-r3
hadoop-fips-3.4.2All versions (No fix recorded)
hadoop-fips-3.5< 3.5.0-r12
infinispan-15.1< 15.1.7-r1
infinispan-15.1-compat< 15.1.7-r1
infinispan-15.1-images< 15.1.7-r1
infinispan-15.2< 15.2.5-r1
infinispan-15.2-compat< 15.2.5-r1
infinispan-15.2-images< 15.2.5-r1
kafka_exporter-strimzi-compat< 0.47.0-r3
kafka-strimzi-compat< 0.47.0-r3
keycloak< 26.3.2-r2
keycloak-26.2< 26.2.5-r1
keycloak-26.2-compat< 26.2.5-r1
keycloak-26.2-iamguarded-compat< 26.2.5-r1
knative-kafka-broker-1.17-dispatcher-loom< 1.17.3-r5
knative-kafka-broker-1.17-receiver-loom< 1.17.3-r5
kserve-modelmesh< 0.12.0-r33
localstack< 4.14.0-r11
management-api-for-apache-cassandra-4.0< 0.1.106-r1
management-api-for-apache-cassandra-4.0-compat< 0.1.106-r1
management-api-for-apache-cassandra-4.1< 0.1.106-r1
management-api-for-apache-cassandra-4.1-compat< 0.1.106-r1
management-api-for-apache-cassandra-5.0< 0.1.106-r1
management-api-for-apache-cassandra-5.0-compat< 0.1.106-r1
opensearch-2-ml-commons< 2.19.4-r0
opensearch-2-performance-analyzer< 2.19.4-r0
opensearch-2-repository-azure< 2.19.4-r0
opensearch-2-repository-s3< 2.19.4-r0
opensearch-2-security-analytics< 2.19.4-r0
prometheus-jmx-exporter-strimzi-compat< 0.47.0-r3
seata-server< 2.7.0-r3
sonarqube< 25.12.0.117093-r1
spark-4.0< 4.0.0-r3
spark-4.0-scala-2.13< 4.0.0-r3
spark-4.0-scala-2.13-compat< 4.0.0-r3
spark-fips-3.5< 3.5.4-r13
spark-fips-3.5-scala-2.12< 3.5.4-r13
spark-fips-3.5-scala-2.12-compat< 3.5.4-r13
spark-fips-3.5-scala-2.13< 3.5.4-r13
spark-fips-3.5-scala-2.13-compat< 3.5.4-r13
strimzi-kafka-operator< 0.47.0-r3
strimzi-kafka-operator-cluster-operator< 0.47.0-r3
strimzi-kafka-operator-kafka-agent< 0.47.0-r3
strimzi-kafka-operator-kafka-base< 0.47.0-r3
strimzi-kafka-operator-kafka-init< 0.47.0-r3
strimzi-kafka-operator-kafka-thirdparty-libs< 0.47.0-r3
strimzi-kafka-operator-kafka-thirdparty-libs-cc< 0.47.0-r3
strimzi-kafka-operator-topic-operator< 0.47.0-r3
strimzi-kafka-operator-tracing-agent< 0.47.0-r3
strimzi-kafka-operator-user-operator< 0.47.0-r3
tez< 0.10.5-r4
thingsboard< 4.1-r6
thingsboard-tb-js-executor< 4.1-r6
thingsboard-tb-mqtt-transport< 4.1-r6
thingsboard-tb-node< 4.1-r6
thingsboard-tb-web-ui< 4.1-r6
trino< 476-r5
trino-config< 476-r5
trino-oci-entrypoint< 476-r5
trino-plugin-ai-functions< 476-r5
trino-plugin-bigquery< 476-r5
trino-plugin-blackhole< 476-r5
trino-plugin-cassandra< 476-r5
trino-plugin-clickhouse< 476-r5
trino-plugin-delta-lake< 476-r5
trino-plugin-druid< 476-r5
trino-plugin-duckdb< 476-r5
trino-plugin-elasticsearch< 476-r5
trino-plugin-exasol< 476-r5
trino-plugin-exchange-filesystem< 476-r5
trino-plugin-exchange-hdfs< 476-r5
trino-plugin-faker< 476-r5
trino-plugin-functions-python< 476-r5
trino-plugin-geospatial< 476-r5
trino-plugin-google-sheets< 476-r5
trino-plugin-hive< 476-r5
trino-plugin-http-event-listener< 476-r5
trino-plugin-http-server-event-listener< 476-r5
trino-plugin-hudi< 476-r5
trino-plugin-iceberg< 476-r5
trino-plugin-ignite< 476-r5
trino-plugin-jmx< 476-r5
trino-plugin-kafka< 476-r5
trino-plugin-kafka-event-listener< 476-r5
trino-plugin-lakehouse< 476-r5
trino-plugin-ldap-group-provider< 476-r5
trino-plugin-loki< 476-r5
trino-plugin-mariadb< 476-r5
trino-plugin-memory< 476-r5
trino-plugin-ml< 476-r5
trino-plugin-mongodb< 476-r5
trino-plugin-mysql< 476-r5
trino-plugin-mysql-event-listener< 476-r5
trino-plugin-opa< 476-r5
trino-plugin-openlineage< 476-r5
trino-plugin-opensearch< 476-r5
trino-plugin-oracle< 476-r5
trino-plugin-password-authenticators< 476-r5
trino-plugin-pinot< 476-r5
trino-plugin-postgresql< 476-r5
trino-plugin-prometheus< 476-r5
trino-plugin-ranger< 476-r5
trino-plugin-redis< 476-r5
trino-plugin-redshift< 476-r5
trino-plugin-resource-group-managers< 476-r5
trino-plugin-session-property-managers< 476-r5
trino-plugin-singlestore< 476-r5
trino-plugin-snowflake< 476-r5
trino-plugin-spooling-filesystem< 476-r5
trino-plugin-sqlserver< 476-r5
trino-plugin-teradata-functions< 476-r5
trino-plugin-thrift< 476-r5
trino-plugin-tpcds< 476-r5
trino-plugin-tpch< 476-r5
trino-plugin-vertica< 476-r5
wildfly< 37.0.0-r1
wildfly-openjdk-17< 37.0.0-r1
wildfly-openjdk-17-compat< 37.0.0-r1
wildfly-openjdk-21< 37.0.0-r1
wildfly-openjdk-21-compat< 37.0.0-r1

Show all 155

Wolfi45 products

akhq< 0.26.0-r3
apache-nifi< 2.5.0-r3
apache-nifi-compat< 2.5.0-r3
apache-nifi-toolkit< 2.5.0-r3
apache-pulsar< 4.0.6-r1

Show all 45

2 vendors · 200 products · Showing 200 of 267

References

15 links

github.com/netty/netty/security/advisories/GHSA-prj3-ccx8-p6x4X Refsource CONFIRMREPORTAdvisoryWEBExploitVendor Advisory
www.kb.cert.org/vuls/id/767506WEB
www.openwall.com/lists/oss-security/2025/08/16/1WEB
www.suse.com/support/update/announcement/2025/suse-su-202503021-1/Advisory
bugzilla.suse.com/1247991REPORT
www.suse.com/security/cve/CVE-2025-55163WEB
ubuntu.com/security/CVE-2025-55163REPORT
www.cve.org/CVERecord?id=CVE-2025-55163REPORT
ubuntu.com/security/notices/USN-8654-1Advisory
security-tracker.debian.org/tracker/CVE-2025-55163Advisory

Show all 15 references