high 7.5

CVE-2025-55163 json

Netty MadeYouReset HTTP/2 DDoS Vulnerability

published 2025-08-13 14 mo ago modified 2026-09-10 1 mo ago also EUVD-2025-28583 , GHSA-prj3-ccx8-p6x4

cvss: 7.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.1%; EPSS 1.1% chance of exploitation in 30 days, percentile 66%
public exploits: 0; none known

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service. This issue has been patched in versions 4.1.124.Final and 4.2.4.Final.

Patch / fix

fixed in 4 distros 5 links 2

maven io.netty:netty-codec-http2 4.1.124.Final, 4.2.4.Final
maven io.grpc:grpc-netty-shaded 1.75.0
io.netty netty-codec-http2 4.1.124.Final, 4.2.4.Final
netty netty 4.1.124.Final, 4.2.4.Final

debian ubuntu red hat suse opensuse

netty Debian 12 1:4.1.48-7+deb12u2
netty Debian 13 1:4.1.48-10+deb13u1
netty Debian 14 1:4.1.48-11

debian advisories DEBIAN-CVE-2025-55163

netty Ubuntu 22.04 LTS 1:4.1.48-4+deb11u2ubuntu0.2
netty Ubuntu 24.04 LTS 1:4.1.48-9ubuntu0.2
netty Ubuntu Pro 16.04 LTS 1:4.0.34-1ubuntu0.1~esm5
netty Ubuntu Pro 18.04 LTS 1:4.1.7-4ubuntu0.1+esm7
netty Ubuntu Pro 20.04 LTS 1:4.1.45-1ubuntu0.1~esm7
netty Ubuntu Pro 22.04 LTS 1:4.1.48-4+deb11u2ubuntu0.2+esm1
netty Ubuntu Pro 24.04 LTS 1:4.1.48-9ubuntu0.2+esm1

ubuntu advisories UBUNTU-CVE-2025-55163

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

eap8-netty jboss enterprise application platform 8.1, jboss enterprise application platform 8.0 4.1.127-1.Final_redhat_00001.1.el8eap
eap8-netty jboss enterprise application platform 8.1, jboss enterprise application platform 8.0 4.1.127-1.Final_redhat_00001.1.el9eap
eap8-wss4j jboss enterprise application platform 8.1, jboss enterprise application platform 8.0 3.0.4-1.redhat_00002.1.el8eap
eap8-wss4j jboss enterprise application platform 8.1, jboss enterprise application platform 8.0 3.0.4-1.redhat_00002.1.el9eap
eap8-wildfly jboss enterprise application platform 8.0 8.0.9-8.GA_redhat_00008.1.el8eap
eap8-wildfly jboss enterprise application platform 8.0 8.0.9-8.GA_redhat_00008.1.el9eap
eap8-opensaml jboss enterprise application platform 8.1, jboss enterprise application platform 8.0 4.3.2-2.redhat_00002.1.el8eap
eap8-opensaml jboss enterprise application platform 8.1, jboss enterprise application platform 8.0 4.3.2-2.redhat_00002.1.el9eap

red hat advisories RHSA-2026:4916 RHSA-2026:4917 RHSA-2026:4915 RHSA-2026:0742 RHSA-2026:0743 RHSA-2025:17317

netty-tcnative SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES for SAP 15 SP3 +12 more 2.0.73-150200.3.30.1
netty SLE Module for Package Hub 15 SP7, SLE Module for Package Hub 15 SP6, openSUSE Leap 15.6 4.1.126-150200.4.34.1
netty Manager Server LTS 4.3 4.1.44.Final-150400.3.9.1

suse advisories SUSE-SU-2025:03114-1 SUSE-SU-2025:03021-1

netty openSUSE Tumbleweed 4.1.124-1.1

opensuse advisories openSUSE-SU-2025:15483-1

github.com/grpc/grpc-java@6462ef9 commit
github.com/netty/netty@be53dc3 commit

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-55163 updated 2026-11-04 cvss 7.5

netty: netty-codec-http2: Netty MadeYouReset HTTP/2 DDoS Vulnerability

Red Hat Logging Subsystem for Red Hat OpenShift netty-codec-http2
affected: workaround, no fix available “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.”
Red Hat OpenShift Serverless openshift-serverless-1/kn-ekb-receiver-rhel8, openshift-serverless-1/kn-ekb-dispatcher-rhel8, openshift-serverless-1/kn-ekb-post-install-rhel8, openshift-serverless-1/kn-ekb-webhook-kafka-rhel8, openshift-serverless-1/kn-ekb-kafka-controller-rhel8, openshift-serverless-1/kn-eventing-integrations-log-sink-rhel8, +8 more Red Hat AMQ Broker 7 netty-codec-http2
affected: workaround, no fix planned “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.”
Red Hat build of Apache Camel - HawtIO 4 netty-codec-http2 Red Hat build of Apache Camel 4 for Quarkus 3 netty-codec-http2
affected: workaround, no fix available “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.”
Red Hat build of Apicurio Registry 2 netty-codec-http2
affected: workaround, no fix planned “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.”
Red Hat build of Apicurio Registry 3 netty-codec-http2
affected: workaround, no fix available “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.”
Red Hat build of Debezium 2 netty-codec-http2 Red Hat build of Debezium 3 netty-codec-http2 Red Hat build of OptaPlanner 8 netty-codec-http2 Red Hat Fuse 7 netty-codec-http2
affected: workaround, no fix planned “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.”
Red Hat JBoss Enterprise Application Platform 7 netty-codec-http2
affected: workaround, no fix available “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.”
Red Hat JBoss Enterprise Application Platform Expansion Pack netty-codec-http2
affected: workaround, no fix planned “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.”

show 25 more

Red Hat OpenShift AI (RHOAI) rhoai/odh-modelmesh-rhel8, rhoai/odh-trustyai-service-rhel8, rhoai/odh-trustyai-service-rhel9
affected: workaround, no fix available “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.”
Red Hat Process Automation 7 netty-codec-http2
affected: workaround, no fix planned “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.”
Red Hat Single Sign-On 7 netty-codec-http2
affected: workaround, no fix available “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.”
Red Hat Cryostat 4 on RHEL 9 cryostat/cryostat-rhel9 4.0.2-3, cryostat/cryostat-db-rhel9 4.0.2-3, cryostat/jfr-datasource-rhel9 4.0.2-3, cryostat/cryostat-reports-rhel9 4.0.2-3, cryostat/cryostat-storage-rhel9 4.0.2-3, cryostat/cryostat-rhel9-operator 4.0.2-3, +5 more
fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2025:14919
Red Hat Build of Apache Camel 4.10 for Quarkus 3.20
fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2025:14197
Red Hat build of Apache Camel 4.10.6 for Spring Boot 3.4.9
fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2025:14911
Red Hat build of Quarkus 3.15.6.SP1
fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2025:14004
Red Hat build of Quarkus 3.20.2.SP1 netty-codec-http2 4.1.121.Final-redhat-00003
fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2025:14008
Red Hat Data Grid 8.5.5
fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2025:15612
Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server eap7-wildfly 7.4.24-4.GA_redhat_00002.1.el7eap, eap7-netty 4.1.124-1.Final_redhat_00001.1.el7eap, eap7-netty-all 4.1.124-1.Final_redhat_00001.1.el7eap, eap7-netty-codec 4.1.124-1.Final_redhat_00001.1.el7eap, eap7-wildfly-modules 7.4.24-4.GA_redhat_00002.1.el7eap, eap7-netty-buffer 4.1.124-1.Final_redhat_00001.1.el7eap, +26 more
fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2026:4915
Red Hat JBoss EAP 7.4 ELS for RHEL 8 eap7-wildfly 7.4.24-4.GA_redhat_00002.1.el8eap, eap7-netty 4.1.124-1.Final_redhat_00001.1.el8eap, eap7-netty-all 4.1.124-1.Final_redhat_00001.1.el8eap, eap7-netty-codec 4.1.124-1.Final_redhat_00001.1.el8eap, eap7-wildfly-modules 7.4.24-4.GA_redhat_00002.1.el8eap, eap7-netty-buffer 4.1.124-1.Final_redhat_00001.1.el8eap, +27 more
fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2026:4916
Red Hat JBoss EAP 7.4 ELS for RHEL 9 eap7-wildfly 7.4.24-4.GA_redhat_00002.1.el9eap, eap7-netty 4.1.124-1.Final_redhat_00001.1.el9eap, eap7-netty-codec 4.1.124-1.Final_redhat_00001.1.el9eap, eap7-wildfly-modules 7.4.24-4.GA_redhat_00002.1.el9eap, eap7-netty-buffer 4.1.124-1.Final_redhat_00001.1.el9eap, eap7-netty-common 4.1.124-1.Final_redhat_00001.1.el9eap, +26 more
fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2026:4917
Red Hat JBoss EAP 8.0 for RHEL 8 eap8-wss4j 3.0.4-1.redhat_00002.1.el8eap, eap8-opensaml 4.3.2-2.redhat_00002.1.el8eap, eap8-apache-cxf 4.0.9-5.redhat_00002.1.el8eap, eap8-cxf-xjc-dv 4.1.0-1.redhat_00001.1.el8eap, eap8-cxf-xjc-ts 4.1.0-1.redhat_00001.1.el8eap, eap8-wildfly 8.0.9-8.GA_redhat_00008.1.el8eap, +49 more Red Hat JBoss EAP 8.0 for RHEL 9 eap8-wss4j 3.0.4-1.redhat_00002.1.el9eap, eap8-opensaml 4.3.2-2.redhat_00002.1.el9eap, eap8-apache-cxf 4.0.9-5.redhat_00002.1.el9eap, eap8-cxf-xjc-dv 4.1.0-1.redhat_00001.1.el9eap, eap8-cxf-xjc-ts 4.1.0-1.redhat_00001.1.el9eap, eap8-wildfly 8.0.9-8.GA_redhat_00008.1.el9eap, +49 more
fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2025:17317
Red Hat JBoss EAP 8.1 for RHEL 8 eap8-wss4j 3.0.4-1.redhat_00002.1.el8eap, eap8-opensaml 4.3.2-2.redhat_00002.1.el8eap, eap8-apache-cxf 4.0.9-4.redhat_00002.1.el8eap, eap8-wildfly 8.1.0-55.GA_redhat_00016.1.el8eap, eap8-wss4j-policy 3.0.4-1.redhat_00002.1.el8eap, eap8-xml-security 3.0.5-1.redhat_00001.1.el8eap, +43 more Red Hat JBoss EAP 8.1 for RHEL 9 eap8-wss4j 3.0.4-1.redhat_00002.1.el9eap, eap8-opensaml 4.3.2-2.redhat_00002.1.el9eap, eap8-apache-cxf 4.0.9-4.redhat_00002.1.el9eap, eap8-wildfly 8.1.0-55.GA_redhat_00016.1.el9eap, eap8-wss4j-policy 3.0.4-1.redhat_00002.1.el9eap, eap8-xml-security 3.0.5-1.redhat_00001.1.el9eap, +43 more
fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2025:17298
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-wildfly 7.1.13-6.GA_redhat_00002.1.ep7.el7, eap7-netty 4.1.63-3.Final_redhat_00004.1.ep7.el7, eap7-jackson-core 2.8.11-3.redhat_00004.1.ep7.el7, eap7-undertow 1.4.18-18.SP16_redhat_00001.1.ep7.el7, eap7-netty-all 4.1.63-3.Final_redhat_00004.1.ep7.el7, eap7-jackson-jaxrs-base 2.8.11-3.redhat_00004.1.ep7.el7, +8 more
fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2026:0742
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-wildfly 7.3.16-3.GA_redhat_00003.1.el7eap, eap7-netty 4.1.63-6.Final_redhat_00004.1.el7eap, eap7-jackson-core 2.10.4-4.redhat_00008.1.el7eap, eap7-undertow 2.0.41-6.SP7_redhat_00001.1.el7eap, eap7-netty-all 4.1.63-6.Final_redhat_00004.1.el7eap, eap7-jackson-databind 2.10.4-6.redhat_00008.1.el7eap, +35 more
fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2026:0743
Red Hat JBoss Enterprise Application Platform 7.4.24 netty-codec-http2 4.1.124.Final-redhat-00001
fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2026:4924
Red Hat JBoss Enterprise Application Platform 8.0.9
fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2025:17318
Red Hat JBoss Enterprise Application Platform 8.1.0 netty-codec 4.1.127.Final-redhat-00001
fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2025:17299
Red Hat OpenShift AI 2.24 rhoai v2.24.0-1759255555
fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2025:17501
Red Hat OpenShift AI 2.25 rhoai v2.25.0-1760531348
fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2025:18989
Red Hat OpenShift Dev Spaces (RHOSDS) 3.24 devspaces 3.24-1759871505, devspaces 3.24-1760747489
fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2025:19094
Red Hat OpenShift Dev Spaces 3.30 devspaces/multicluster-redirector-rhel9 1787764643
fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2026:62260
Red Hat Streams for Apache Kafka 2.9.2
fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2025:15697
Red Hat Streams for Apache Kafka 3.0.1
fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2025:16407

1 more fixed, 12 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 14 mo ago (2025-08-13)

Exploit prediction

1.13% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/netty/netty/security/advisories/GHSA-prj3-ccx8-p6x4 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	8.2	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
GitHub	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA	4.0	8.2	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
maven	io.netty:netty-codec-http2	>=4.2.0.Alpha1, <4.2.4.Final <4.1.124.Final	4.2.4.Final 4.1.124.Final
maven	io.grpc:grpc-netty-shaded	<1.75.0	1.75.0

Affected products

netty netty

Classification

Weakness

CWE-770 Allocation of Resources Without Limits or Throttling

References

github.com /grpc/grpc-java/commit/6462ef9a11980e168c21d90bbc7245c728fd1a7a
web
github.com /netty/netty/commit/be53dc3c9acd9af2e20d0c3c07cd77115a594cf1
web
github.com /netty/netty/security/advisories/GHSA-prj3-ccx8-p6x4
web, exploit, vendor-advisory
kb.cert.org /vuls/id/767506
web
openwall.com /lists/oss-security/2025/08/16/1
web
nvd.nist.gov /vuln/detail/CVE-2025-55163
advisory
github.com /netty/netty
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary