CVE-2025-55163

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service. This issue has been patched in versions 4.1.124.Final and 4.2.4.Final.

References

Affected packages

Debian:11 / netty

Package

Name: netty
Purl: pkg:deb/debian/netty?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1:4.*

1:4.1.48-4

1:4.1.48-4+deb11u1

1:4.1.48-4+deb11u2

1:4.1.48-5

1:4.1.48-6

1:4.1.48-7

1:4.1.48-8

1:4.1.48-9

1:4.1.48-10

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / netty

Package

Name: netty
Purl: pkg:deb/debian/netty?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1:4.*

1:4.1.48-7

1:4.1.48-7+deb12u1

1:4.1.48-8

1:4.1.48-9

1:4.1.48-10

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / netty

Package

Name: netty
Purl: pkg:deb/debian/netty?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1:4.*

1:4.1.48-10

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:14 / netty

Package

Name: netty
Purl: pkg:deb/debian/netty?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1:4.*

1:4.1.48-10

Ecosystem specific

{
    "urgency": "not yet assigned"
}