CVE-2025-55163

Name of the Vulnerable Software and Affected Versions: Netty versions prior to 4.1.124.Final Netty versions prior to 4.2.4.Final

Description: Netty is an asynchronous, event-driven network application framework vulnerable to a MadeYouReset DDoS attack. This issue is a logical vulnerability in the HTTP/2 protocol, triggered by malformed HTTP/2 control frames that bypass the maximum concurrent streams limit, leading to resource exhaustion and a distributed denial of service.

Recommendations: Netty versions prior to 4.1.124.Final: Update to version 4.1.124.Final or later. Netty versions prior to 4.2.4.Final: Update to version 4.2.4.Final or later.