Skip to content
OpenAdvisories
High · 8.2 Public exploit CVE-2025-55163 EUVD-2025-28583GHSA-prj3-ccx8-p6x4

Netty MadeYouReset HTTP/2 DDoS Vulnerability

Published Aug 13, 2025 · Updated Nov 4, 2025 · Assigned by GitHub_M

Vendor: netty Product: netty Package: akhq Package: apache-nifi Package: apache-nifi-compat Package: apache-nifi-toolkit Package: apicurio-registry Package: apicurio-registry-nginx-config Package: apicurio-registry-ui Package: celeborn-0.6 Package: docker-selenium-standalone-chrome Package: druid Package: druid-compat Package: flyway Package: io.grpc:grpc-netty-shaded Package: io.netty:netty-codec-http2 Package: kafka_exporter-strimzi-compat Package: kafka-strimzi-compat Package: kserve-modelmesh Package: management-api-for-apache-cassandra-5.0 Package: management-api-for-apache-cassandra-5.0-compat Package: netty Package: netty Package: prometheus-jmx-exporter-strimzi-compat Package: sonarqube Package: spark-4.0 Package: spark-4.0-scala-2.13 Package: spark-4.0-scala-2.13-compat Package: strimzi-kafka-operator Package: strimzi-kafka-operator-cluster-operator Package: strimzi-kafka-operator-kafka-agent Package: strimzi-kafka-operator-kafka-base Package: strimzi-kafka-operator-kafka-init Package: strimzi-kafka-operator-kafka-thirdparty-libs Package: strimzi-kafka-operator-kafka-thirdparty-libs-cc Package: strimzi-kafka-operator-topic-operator Package: strimzi-kafka-operator-tracing-agent Package: strimzi-kafka-operator-user-operator Package: tez Package: thingsboard Package: thingsboard-tb-js-executor Package: thingsboard-tb-mqtt-transport Package: thingsboard-tb-node Package: thingsboard-tb-web-ui Package: trino Package: trino-config Package: trino-oci-entrypoint Package: trino-plugin-ai-functions Package: trino-plugin-bigquery Package: trino-plugin-blackhole Package: trino-plugin-cassandra Package: trino-plugin-clickhouse Package: trino-plugin-delta-lake Package: trino-plugin-druid Package: trino-plugin-duckdb Package: trino-plugin-elasticsearch Package: trino-plugin-exasol Package: trino-plugin-exchange-filesystem Package: trino-plugin-exchange-hdfs Package: trino-plugin-faker Package: trino-plugin-functions-python Package: trino-plugin-geospatial Package: trino-plugin-google-sheets Package: trino-plugin-hive Package: trino-plugin-http-event-listener Package: trino-plugin-http-server-event-listener Package: trino-plugin-hudi Package: trino-plugin-iceberg Package: trino-plugin-ignite Package: trino-plugin-jmx Package: trino-plugin-kafka Package: trino-plugin-kafka-event-listener Package: trino-plugin-lakehouse Package: trino-plugin-ldap-group-provider Package: trino-plugin-loki Package: trino-plugin-mariadb Package: trino-plugin-memory Package: trino-plugin-ml Package: trino-plugin-mongodb Package: trino-plugin-mysql Package: trino-plugin-mysql-event-listener Package: trino-plugin-opa Package: trino-plugin-openlineage Package: trino-plugin-opensearch Package: trino-plugin-oracle Package: trino-plugin-password-authenticators Package: trino-plugin-pinot Package: trino-plugin-postgresql Package: trino-plugin-prometheus Package: trino-plugin-ranger Package: trino-plugin-redis Package: trino-plugin-redshift Package: trino-plugin-resource-group-managers Package: trino-plugin-session-property-managers Package: trino-plugin-singlestore Package: trino-plugin-snowflake Package: trino-plugin-spooling-filesystem Package: trino-plugin-sqlserver Package: trino-plugin-teradata-functions Package: trino-plugin-thrift Package: trino-plugin-tpcds Package: trino-plugin-tpch Package: trino-plugin-vertica Package: wildfly Package: wildfly-openjdk-17 Package: wildfly-openjdk-17-compat Package: wildfly-openjdk-21 Package: wildfly-openjdk-21-compat Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service. This issue has been patched in versions 4.1.124.Final and 4.2.4.Final.

Affected products

VendorProductAffectedFixed
netty netty < 4.1.124.Final, < 4.2.4.Final —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 netty 1:4.1.48-11 —
Debian 13 netty 1:4.1.48-10+deb13u1 DSA-6160-1
Debian 12 netty 1:4.1.48-7+deb12u2 DSA-6160-1
Debian 11 netty 1:4.1.48-4+deb11u3 DLA-4519-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 netty No fix yet —
Ubuntu 25.10 netty No fix yet —
Ubuntu 24.04 LTS netty 1:4.1.48-9ubuntu0.2 USN-8654-1
Ubuntu 22.04 LTS netty 1:4.1.48-4+deb11u2ubuntu0.2 USN-8654-1
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS netty 1:4.1.48-9ubuntu0.2+esm1 —
Ubuntu Pro 22.04 LTS netty 1:4.1.48-4+deb11u2ubuntu0.2+esm1 —
Ubuntu Pro 20.04 LTS netty 1:4.1.45-1ubuntu0.1~esm7 USN-8654-1
Ubuntu Pro 18.04 LTS netty 1:4.1.7-4ubuntu0.1+esm7 USN-8654-1
Ubuntu Pro 16.04 LTS netty 1:4.0.34-1ubuntu0.1~esm5 USN-8654-1
Ubuntu Pro 14.04 LTS netty No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-jackson-annotations +3 2.8.11-2.redhat_00004.1.ep7.el7 RHSA-2026:0743, RHSA-2026:0742
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-jackson-core +4 2.8.11-3.redhat_00004.1.ep7.el7 RHSA-2026:0743, RHSA-2026:0742
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-jackson-databind +1 2.10.4-6.redhat_00008.1.el7eap RHSA-2026:0743
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-jboss-server-migration +21 1.7.2-20.Final_redhat_00021.1.el7eap RHSA-2026:0743
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-netty +1 4.1.63-3.Final_redhat_00004.1.ep7.el7 RHSA-2026:0743, RHSA-2026:0742
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-undertow 1.4.18-18.SP16_redhat_00001.1.ep7.el7 RHSA-2026:0743, RHSA-2026:0742
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly +1 7.1.13-6.GA_redhat_00002.1.ep7.el7 RHSA-2026:0743, RHSA-2026:0742
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly-javadocs +2 7.3.16-3.GA_redhat_00003.1.el7eap RHSA-2026:0743
Red Hat Jboss Enterprise Application Platform Els 7 eap7-apache-cxf +3 3.5.11-1.SP1_redhat_00001.1.el7eap RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915
Red Hat Jboss Enterprise Application Platform Els 7 eap7-eclipse-jgit 5.13.5.202508271544-2.r_redhat_00001.1.el7eap RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915
Red Hat Jboss Enterprise Application Platform Els 7 eap7-hibernate +4 5.3.38-1.Final_redhat_00001.1.el7eap RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915
Red Hat Jboss Enterprise Application Platform Els 7 eap7-jboss-marshalling +1 2.0.16-1.Final_redhat_00001.1.el7eap RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915
Red Hat Jboss Enterprise Application Platform Els 7 eap7-netty +26 4.1.124-1.Final_redhat_00001.1.el7eap RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915
Red Hat Jboss Enterprise Application Platform Els 7 eap7-undertow 2.2.39-1.Final_redhat_00001.1.el7eap RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915
Red Hat Jboss Enterprise Application Platform Els 7 eap7-wildfly +4 7.4.24-4.GA_redhat_00002.1.el7eap RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915
Red Hat Jboss Enterprise Application Platform Els 7 eap7-wildfly-java-jdk17 7.4.24-4.GA_redhat_00002.1.el8eap RHSA-2026:4917, RHSA-2026:4916
Red Hat JBoss EAP 8 eap8-apache-commons-lang 3.18.0-1.redhat_00002.1.el8eap RHSA-2025:17298
Red Hat JBoss EAP 8 eap8-apache-cxf +3 4.0.9-4.redhat_00002.1.el8eap RHSA-2025:17317, RHSA-2025:17298
Red Hat JBoss EAP 8 eap8-cxf-xjc-dv +5 4.1.0-1.redhat_00001.1.el8eap RHSA-2025:17317
Red Hat JBoss EAP 8 eap8-eap-product-conf-parent +1 800.9.1-3.GA_redhat_00004.1.el8eap RHSA-2025:17317, RHSA-2025:17298
Red Hat JBoss EAP 8 eap8-jbossws-cxf 7.3.4-1.Final_redhat_00001.1.el8eap RHSA-2025:17317, RHSA-2025:17298
Red Hat JBoss EAP 8 eap8-netty +14 4.1.127-1.Final_redhat_00001.1.el8eap RHSA-2025:17317, RHSA-2025:17298
Red Hat JBoss EAP 8 eap8-opensaml +13 4.3.2-2.redhat_00002.1.el8eap RHSA-2025:17317, RHSA-2025:17298
Red Hat JBoss EAP 8 eap8-wildfly +4 8.0.9-8.GA_redhat_00008.1.el8eap RHSA-2025:17317, RHSA-2025:17298
Red Hat JBoss EAP 8 eap8-wss4j +6 3.0.4-1.redhat_00002.1.el8eap RHSA-2025:17317, RHSA-2025:17298
Red Hat JBoss EAP 8 eap8-xml-security 3.0.5-1.redhat_00001.1.el8eap RHSA-2025:17317, RHSA-2025:17298

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 netty 4.1.126-150200.4.34.1 SUSE-SU-2025:03114-1
SLES 15 SP7 netty-tcnative 2.0.73-150200.3.30.1 SUSE-SU-2025:03114-1
SLES 15 SP6 netty 4.1.126-150200.4.34.1 SUSE-SU-2025:03114-1
SLES 15 SP6 netty-tcnative 2.0.73-150200.3.30.1 SUSE-SU-2025:03114-1
SLES 15 SP5 netty-tcnative 2.0.73-150200.3.30.1 SUSE-SU-2025:03114-1
SLES 15 SP4 netty-tcnative 2.0.73-150200.3.30.1 SUSE-SU-2025:03114-1
SLES 15 SP3 netty-tcnative 2.0.73-150200.3.30.1 SUSE-SU-2025:03114-1
Show 8 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP5 netty-tcnative 2.0.73-150200.3.30.1 SUSE-SU-2025:03114-1
SLES for SAP 15 SP4 netty-tcnative 2.0.73-150200.3.30.1 SUSE-SU-2025:03114-1
SLES for SAP 15 SP3 netty-tcnative 2.0.73-150200.3.30.1 SUSE-SU-2025:03114-1
SLE HPC 15 SP5 netty-tcnative 2.0.73-150200.3.30.1 SUSE-SU-2025:03114-1
SLE HPC 15 SP4 netty-tcnative 2.0.73-150200.3.30.1 SUSE-SU-2025:03114-1
SLE HPC 15 SP3 netty-tcnative 2.0.73-150200.3.30.1 SUSE-SU-2025:03114-1
SUSE Manager Server LTS 4.3 netty 4.1.44.Final-150400.3.9.1 SUSE-SU-2025:03021-1
SUSE Enterprise Storage 7.1 netty-tcnative 2.0.73-150200.3.30.1 SUSE-SU-2025:03114-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed netty 4.1.124-1.1 openSUSE-SU-2025:15483-1
openSUSE Leap 15.6 netty 4.1.126-150200.4.34.1 SUSE-SU-2025:03114-1
openSUSE Leap 15.6 netty-tcnative 2.0.73-150200.3.30.1 SUSE-SU-2025:03114-1

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling akhq 0.26.0-r3 —
Wolfi rolling apache-nifi +2 2.5.0-r3 —
Wolfi rolling apicurio-registry +2 3.0.12-r1 —
Wolfi rolling celeborn-0.6 0.6.3-r7 —
Wolfi rolling docker-selenium-standalone-chrome No fix yet —
Wolfi rolling druid +1 34.0.0-r1 —
Wolfi rolling flyway 11.11.0-r1 —
Wolfi rolling kafka-strimzi-compat +12 0.47.0-r3 —
Wolfi rolling kserve-modelmesh 0.12.0-r33 —
Wolfi rolling management-api-for-apache-cassandra-5.0 +1 0.1.106-r1 —
Wolfi rolling sonarqube 25.12.0.117093-r1 —
Wolfi rolling spark-4.0 +2 4.0.0-r3 —
Wolfi rolling tez 0.10.5-r4 —
Wolfi rolling thingsboard +4 4.1-r6 —
Wolfi rolling trino +58 476-r5 —
Wolfi rolling wildfly +4 37.0.0-r1 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • xiaoqiMikko/netty-http2-check ★ 0 · Sep 5, 2026

    CVE-2025-55163 / CVE-2026-56819: offline checker for the 7 netty-codec-http2 CVEs. Tells you which ones you are exposed to, and the one version that fixes all seven (4.1.136.Final / 4.2.16.Final) - w…

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven io.grpc:grpc-netty-shaded < 1.75.0 1.75.0 GHSA-prj3-ccx8-p6x4
Maven io.netty:netty-codec-http2 >= 4.2.0.Alpha1, < 4.2.4.Final 4.2.4.Final GHSA-prj3-ccx8-p6x4
Maven io.netty:netty-codec-http2 < 4.1.124.Final 4.1.124.Final GHSA-prj3-ccx8-p6x4

Advisories 40

References