CVE-2025-55163CWE-770

Netty MadeYouReset HTTP/2 DDoS Vulnerability

High · published August 13, 2025

CVSS v4.0
8.2
EPSS
1%
Percentile
65.4
In the wild
Unconfirmed
What it is

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service. This issue has been patched in versions 4.1.124.Final and 4.2.4.Final.

The record
Technical detail
CVSS v4.0
8.2 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.01101 · 65.4th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2025-08-13T14:17Z
EPSS history
Timeline
  • 13 AUG 14:17Z
    Netty MadeYouReset HTTP/2 DDoS Vulnerability
    cvelistv5