CVE-2025-55163highCWE-770

CVE-2025-55163: high-severity vulnerability in netty

Netty MadeYouReset HTTP/2 DDoS Vulnerability

Published · Updated

Follow this CVE+ Monitor netty+ Monitor netty

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.2epss 1.1%
In short

Netty's HTTP/2 implementation is vulnerable to a DDoS attack using specially crafted control frames that bypass stream limits, causing the server to exhaust resources and stop responding to legitimate requests.

Technical detail

A logical flaw in HTTP/2 protocol handling allows attackers to craft malformed control frames that circumvent max concurrent streams enforcement, leading to unbounded resource consumption and denial of service. Exploitation requires network access to send malicious frames; patched in versions 4.1.124.Final and 4.2.4.Final.

Summary generated and translated by AI from the official description.
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service. This issue has been patched in versions 4.1.124.Final and 4.2.4.Final.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
netty · netty
Related CVEs — netty

In the same product, most dangerous first.

CVE-2021-21409MEDIUMPossible request smuggling in HTTP/2 due missing validation of content-lengthEPSS 4.9%CVE-2021-43797MEDIUMHTTP fails to validate against control chars in header names which may lead to HTTP request smugglingEPSS 2.9%CVE-2023-34462MEDIUMnetty-handler SniHandler 16MB allocationEPSS 2.5%CVE-2025-24970HIGHSslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngineEPSS 2.2%CVE-2021-21290MEDIUMLocal Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary filesEPSS 1.8%CVE-2022-41881MEDIUMCVE-2022-41881EPSS 1.6%