Read the docs
TI-2025-34845 Aliases CVE-2025-55163GHSA-prj3-ccx8-p6x4

Netty MadeYouReset HTTP/2 DDoS Vulnerability

Priority MEDIUM 44CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 25 fixed, 16 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.

Summary

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service. This issue has been patched in versions 4.1.124.Final and 4.2.4.Final.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01125 66th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial netty (netty): 4.1.124.Final, 4.2.4.Finalio.netty:netty-codec-http2 (Maven): 4.2.4.Final, 4.1.124.Final+1 more productRed Hat: 23 advisoriesRed Hat: 25 fixed, 16 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nettynettybefore 4.1.124.Final; before 4.2.4.Final4.1.124.Final, 4.2.4.FinalPatch availableCNA
—io.netty:netty-codec-http2 (Maven)4.2.0.Alpha1 to before 4.2.4.Final4.2.4.FinalPatch availableGHSA-prj3-ccx8-p6x4
—io.netty:netty-codec-http2 (Maven)before 4.1.124.Final4.1.124.FinalPatch availableGHSA-prj3-ccx8-p6x4
—io.grpc:grpc-netty-shaded (Maven)before 1.75.01.75.0Patch availableGHSA-prj3-ccx8-p6x4
  • netty Vendornetty Affected before 4.1.124.Final; before 4.2.4.Final Fixed in 4.1.124.Final, 4.2.4.Final Patch available CNA
  • io.netty:netty-codec-http2 (Maven) Vendor— Affected 4.2.0.Alpha1 to before 4.2.4.Final Fixed in 4.2.4.Final Patch available GHSA-prj3-ccx8-p6x4
  • io.netty:netty-codec-http2 (Maven) Vendor— Affected before 4.1.124.Final Fixed in 4.1.124.Final Patch available GHSA-prj3-ccx8-p6x4
  • io.grpc:grpc-netty-shaded (Maven) Vendor— Affected before 1.75.0 Fixed in 1.75.0 Patch available GHSA-prj3-ccx8-p6x4

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*before 4.1.124; 4.2.0 to before 4.2.4Vulnerablenetty
  • cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* Versions before 4.1.124; 4.2.0 to before 4.2.4 Vulnerable ·netty

Remediation

  • Fix · CNA netty (netty) Fixed in 4.1.124.Final, 4.2.4.Final
  • Fix · GHSA-prj3-ccx8-p6x4 io.netty:netty-codec-http2 (Maven) Fixed in 4.2.4.Final Advisory →
  • Fix · GHSA-prj3-ccx8-p6x4 io.netty:netty-codec-http2 (Maven) Fixed in 4.1.124.Final Advisory →
  • Fix · GHSA-prj3-ccx8-p6x4 io.grpc:grpc-netty-shaded (Maven) Fixed in 1.75.0 Advisory →

Red Hat 23 advisories

  • RHSA-2026:62260 Released 2026-09-01 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.30.0 Release.
    • Red Hat OpenShift Dev Spaces 3.30 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +7
  • RHSA-2026:4924 Released 2026-03-18 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.24 security update
    • Red Hat JBoss Enterprise Application Platform 7.4.24 io.netty.netty-codec-http2-4.1.124.Final-redhat-00001.jar, io.undertow.undertow-core-2.2.39.Final-redhat-00001.jar, org.apache.cxf.cxf-rt-transports-jms-3.5.11.SP1-redhat-00001.jar +2
  • RHSA-2026:4917 Released 2026-03-18 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.24 security update
    • Red Hat JBoss EAP 7.4 ELS for RHEL 9 eap7-apache-cxf-3.5.11-1.SP1_redhat_00001.1.el9eap, eap7-apache-cxf-rt-3.5.11-1.SP1_redhat_00001.1.el9eap, eap7-apache-cxf-services-3.5.11-1.SP1_redhat_00001.1.el9eap +40
Show 20 more Red Hat advisories
  • RHSA-2026:4915 Released 2026-03-18 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.24 security update
    • Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server eap7-apache-cxf-3.5.11-1.SP1_redhat_00001.1.el7eap, eap7-apache-cxf-rt-3.5.11-1.SP1_redhat_00001.1.el7eap, eap7-apache-cxf-services-3.5.11-1.SP1_redhat_00001.1.el7eap +42
  • RHSA-2026:4916 Released 2026-03-18 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.24 security update
    • Red Hat JBoss EAP 7.4 ELS for RHEL 8 eap7-apache-cxf-3.5.11-1.SP1_redhat_00001.1.el8eap, eap7-apache-cxf-rt-3.5.11-1.SP1_redhat_00001.1.el8eap, eap7-apache-cxf-services-3.5.11-1.SP1_redhat_00001.1.el8eap +43
  • RHSA-2026:0743 Released 2026-01-19 · Red Hat rating Critical
    Red Hat JBoss Enterprise Application Platform 7.3.16 security update
    • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-jackson-annotations-2.10.4-4.redhat_00008.1.el7eap, eap7-jackson-core-2.10.4-4.redhat_00008.1.el7eap, eap7-jackson-databind-2.10.4-6.redhat_00008.1.el7eap +38
  • RHSA-2026:0742 Released 2026-01-19 · Red Hat rating Critical
    Red Hat JBoss Enterprise Application Platform 7.1.13 on RHEL 7 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-jackson-annotations-2.8.11-2.redhat_00004.1.ep7.el7, eap7-jackson-core-2.8.11-3.redhat_00004.1.ep7.el7, eap7-jackson-datatype-jdk8-2.8.11-2.redhat_00004.1.ep7.el7 +11
  • RHSA-2025:23417 Released 2025-12-16 · Red Hat rating Important
    Streams for Apache Kafka 3.1.0 release and security update
    • Streams for Apache Kafka 3.1.0
  • RHSA-2025:19094 Released 2025-10-23 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.24.0 Release.
    • Red Hat OpenShift Dev Spaces (RHOSDS) 3.24 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/openvsx-rhel9 +4
  • RHSA-2025:18989 Released 2025-10-22 · Red Hat rating Important
    RHOAI 2.25.0 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-modelmesh-rhel9
  • RHSA-2025:17501 Released 2025-10-07 · Red Hat rating Important
    RHOAI 2.24.0 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.24 registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-modelmesh-rhel9, registry.redhat.io/rhoai/odh-rhel9-operator
  • RHSA-2025:17317 Released 2025-10-02 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.0.9 security update
    • Red Hat JBoss EAP 8.0 for RHEL 8 eap8-apache-cxf-4.0.9-5.redhat_00002.1.el8eap, eap8-apache-cxf-rt-4.0.9-5.redhat_00002.1.el8eap, eap8-apache-cxf-services-4.0.9-5.redhat_00002.1.el8eap +47
    • Red Hat JBoss EAP 8.0 for RHEL 9 eap8-apache-cxf-4.0.9-5.redhat_00002.1.el9eap, eap8-apache-cxf-rt-4.0.9-5.redhat_00002.1.el9eap, eap8-apache-cxf-services-4.0.9-5.redhat_00002.1.el9eap +47
  • RHSA-2025:17318 Released 2025-10-02 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.0.9 security update
    • Red Hat JBoss Enterprise Application Platform 8.0.9
  • RHSA-2025:17298 Released 2025-10-02 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.0 security update
    • Red Hat JBoss EAP 8.1 for RHEL 8 eap8-apache-commons-lang-3.18.0-1.redhat_00002.1.el8eap, eap8-apache-cxf-4.0.9-4.redhat_00002.1.el8eap, eap8-apache-cxf-rt-4.0.9-4.redhat_00002.1.el8eap +46
    • Red Hat JBoss EAP 8.1 for RHEL 9 eap8-apache-commons-lang-3.18.0-1.redhat_00002.1.el9eap, eap8-apache-cxf-4.0.9-4.redhat_00002.1.el9eap, eap8-apache-cxf-rt-4.0.9-4.redhat_00002.1.el9eap +46
  • RHSA-2025:17299 Released 2025-10-02 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.0 security update
    • Red Hat JBoss Enterprise Application Platform 8.1.0 io.netty.netty-codec-4.1.127.Final-redhat-00001.jar, io.netty.netty-codec-http-4.1.127.Final-redhat-00001.jar, org.apache.cxf.cxf-rt-transports-jms-4.0.9.redhat-00002.jar +1
  • RHSA-2025:16407 Released 2025-09-22 · Red Hat rating Important
    Streams for Apache Kafka 3.0.1 release and security update
    • Streams for Apache Kafka 3.0.1
  • RHSA-2025:15697 Released 2025-09-11 · Red Hat rating Important
    Streams for Apache Kafka 2.9.2 release and security update
    • Streams for Apache Kafka 2.9.2
  • RHSA-2025:15612 Released 2025-09-10 · Red Hat rating Important
    Red Hat Data Grid 8.5.5 security update
    • Red Hat Data Grid 8.5.5
  • RHSA-2025:14919 Released 2025-09-03 · Red Hat rating Important
    Red Hat build of Cryostat 4.0.2: new RHEL 9 container image security update
    • Cryostat 4 on RHEL 9 cryostat/cryostat-agent-init-rhel9, cryostat/cryostat-db-rhel9, cryostat/cryostat-grafana-dashboard-rhel9 +8
  • RHSA-2025:14911 Released 2025-08-28 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.10.6 for Spring Boot release.
    • Red Hat build of Apache Camel 4.10.6 for Spring Boot 3.4.9
  • RHSA-2025:14197 Released 2025-08-20 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.10 for Quarkus 3.20 update is now available (RHBQ 3.20.2.GA)
    • Red Hat Build of Apache Camel 4.10 for Quarkus 3.20
  • RHSA-2025:14008 Released 2025-08-19 · Red Hat rating Important
    Red Hat build of Quarkus 3.20.2.SP1 security update
    • Red Hat build of Quarkus 3.20.2.SP1 io.netty.netty-codec-http2-4.1.121.Final-redhat-00003.jar
  • RHSA-2025:14004 Released 2025-08-19 · Red Hat rating Important
    Red Hat build of Quarkus 3.15.6.SP1 security update
    • Red Hat build of Quarkus 3.15.6.SP1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Logging Subsystem for Red Hat OpenShiftAffectedNo fix yet
OpenShift ServerlessAffectedNo fix planned: Will not fix
Red Hat AMQ Broker 7AffectedNo fix planned: Will not fix
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 7AffectedNo fix yet
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix planned: Will not fix
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat Process Automation 7AffectedNo fix planned: Will not fix
Red Hat Single Sign-On 7AffectedNo fix yet: Fix deferred
Red Hat build of Apache Camel - HawtIO 4AffectedNo fix yet
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet
Red Hat build of Apicurio Registry 2AffectedNo fix planned: Will not fix
Red Hat build of Apicurio Registry 3AffectedNo fix yet
Red Hat build of Debezium 2AffectedNo fix planned: Will not fix
Red Hat build of Debezium 3AffectedNo fix planned: Will not fix
Red Hat build of OptaPlanner 8AffectedNo fix planned: Will not fix
Cryostat 4 on RHEL 9Fixed RHSA-2025:14919
Red Hat Build of Apache Camel 4.10 for Quarkus 3.20Fixed RHSA-2025:14197
Red Hat Data Grid 8.5.5Fixed RHSA-2025:15612
Red Hat JBoss EAP 7.4 ELS for RHEL 7 ServerFixed RHSA-2026:4915
Red Hat JBoss EAP 7.4 ELS for RHEL 8Fixed RHSA-2026:4916
Red Hat JBoss EAP 7.4 ELS for RHEL 9Fixed RHSA-2026:4917
Red Hat JBoss EAP 8.0 for RHEL 8Fixed RHSA-2025:17317
Red Hat JBoss EAP 8.0 for RHEL 9Fixed RHSA-2025:17317
Red Hat JBoss EAP 8.1 for RHEL 8Fixed RHSA-2025:17298
Red Hat JBoss EAP 8.1 for RHEL 9Fixed RHSA-2025:17298
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 ServerFixed RHSA-2026:0742
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 ServerFixed RHSA-2026:0743
Red Hat JBoss Enterprise Application Platform 7.4.24Fixed RHSA-2026:4924
Red Hat JBoss Enterprise Application Platform 8.0.9Fixed RHSA-2025:17318
Red Hat JBoss Enterprise Application Platform 8.1.0Fixed RHSA-2025:17299
Red Hat OpenShift AI 2.24Fixed RHSA-2025:17501
Red Hat OpenShift AI 2.25Fixed RHSA-2025:18989
Red Hat OpenShift Dev Spaces (RHOSDS) 3.24Fixed RHSA-2025:19094
Red Hat OpenShift Dev Spaces 3.30Fixed RHSA-2026:62260
Red Hat build of Apache Camel 4.10.6 for Spring Boot 3.4.9Fixed RHSA-2025:14911
Red Hat build of Quarkus 3.15.6.SP1Fixed RHSA-2025:14004
Red Hat build of Quarkus 3.20.2.SP1Fixed RHSA-2025:14008
Streams for Apache Kafka 2.9.2Fixed RHSA-2025:15697
Streams for Apache Kafka 3.0.1Fixed RHSA-2025:16407
Streams for Apache Kafka 3.1.0Fixed RHSA-2025:23417
Not affected: 12 products
  • Red Hat AMQ Clients
  • Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server
  • Red Hat JBoss EAP 7.4 ELS for RHEL 8
  • Red Hat JBoss EAP 7.4 ELS for RHEL 9
  • Red Hat JBoss Enterprise Application Platform 7.4.24
  • Red Hat JBoss Enterprise Application Platform 8.1.0
  • Red Hat OpenShift AI 2.24
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift Dev Spaces
  • Red Hat OpenShift Dev Spaces (RHOSDS) 3.24
  • Red Hat OpenShift Dev Spaces 3.30
  • Red Hat build of Quarkus 3.20.2.SP1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-55163
  2. 2026-10-03 Alias added: GHSA-prj3-ccx8-p6x4
  3. 2026-10-09 Fix available: RHSA-2025:14911 · Red Hat
  4. 2026-10-16 Fix available: Red Hat JBoss Enterprise Application Platform 8.1.0, Red Hat build of Apache Camel 4.10.6 for Spring Boot 3.4.9 · Red Hat
  5. 2026-10-20 Affected versions changed · Red Hat

References

Exploit 1

Advisory 1

Other 5

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-30861 Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization CVSS 3.1CRITICAL 9.8
  • TI-2026-30864 Netty: HttpClientCodec response desynchronization CVSS 3.1CRITICAL 9.1
  • TI-2026-30859 Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) CVSS 3.1CRITICAL 9.1
  • TI-2026-40973 Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks CVSS 3.1CRITICAL 9.1
  • TI-2026-40972 Uncontrolled resource consumption in netty CVSS 3.1HIGH 7.5
See all 92 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences