UBUNTU-CVE-2025-55163
Advisory lineage Upstream: 1 Downstream: 1
Upstream
Downstream
Published: 13 Aug 2025, 15:15
Last modified:08 Jun 2026, 18:55
Vulnerability Summary
Overall Risk (default)
medium
33/100 CVSS Score
8.2 HIGH
4.0 (osv_ubuntu)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
13 Aug 2025, 15:15
Published
Vulnerability first disclosed
08 Jun 2026, 18:55
Last Modified
Vulnerability information updated
Description
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service. This issue has been patched in versions 4.1.124.Final and 4.2.4.Final.
CVSS Metrics
- v4.0•HIGH•Score: 8.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Systems
- ubuntu•netty
all | all | all