Summary
It was discovered that Netty did not properly handle malformed HTTP/2
control frames. An attacker could use this to cause a denial of service
via resource exhaustion. This issue only affects Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2025-55163)
It was discovered that Netty did not properly validate the request URI
for line-break characters. An attacker could use this to perform CRLF
injection and request smuggling. (CVE-2025-67735)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | netty | 1:4.1.48-4+deb11u2ubuntu0.2 |
| Ubuntu · 24.04 LTS 24.04:LTS | netty | 1:4.1.48-9ubuntu0.2 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | netty | 1:4.0.34-1ubuntu0.1~esm5 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | netty | 1:4.1.7-4ubuntu0.1+esm7 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | netty | 1:4.1.45-1ubuntu0.1~esm7 |
Vulnerabilities 2
-
High 8.2CVE-2025-55163 Public exploit
Netty MadeYouReset HTTP/2 DDoS Vulnerability
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames …
-
Medium 6.5
Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the `io.netty.handler.codec.http.HttpRequestEncoder` has a CRLF injection with the request URI when constructing a request. This leads to…