Netty MadeYouReset HTTP/2 DDoS Vulnerability
概要
Netty MadeYouReset HTTP/2 DDoS Vulnerability
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service. This issue has been patched in versions 4.1.124.Final and 4.2.4.Final.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2025-55163 netty 修正版: 1:4.1.48-4+deb11u3
- Ubuntu UBUNTU-CVE-2025-55163 netty
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web openwall.com
- web kb.cert.org