Netty MadeYouReset HTTP/2 DDoS Vulnerability
Résumé
Netty MadeYouReset HTTP/2 DDoS Vulnerability
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service. This issue has been patched in versions 4.1.124.Final and 4.2.4.Final.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2025-55163 netty Corrigé dans: 1:4.1.48-4+deb11u3
- Ubuntu UBUNTU-CVE-2025-55163 netty
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web openwall.com
- web kb.cert.org