CVE-2025-55163

Katalog CVE

CVSS 7.5 · High EPSS 1,1%

Kerentanan Allocation of Resources Without Limits or Throttling pada netty. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service. This issue has been patched in versions 4.1.124.Final and 4.2.4.Final.

Rincian

Terbit di NVD

13 Agustus 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 64,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/netty/netty/security/advisories/GHSA-prj3-ccx8-p6x4 exploit · advisory vendor
• http://www.openwall.com/lists/oss-security/2025/08/16/1
• https://www.kb.cert.org/vuls/id/767506