Skip to content

Conversation

ivo-vachkov
Copy link

@ivo-vachkov ivo-vachkov commented Aug 20, 2025

... to address CVE-2025-55163

Date: August 13, 2025

Netty is an asynchronous, event-driven network application framework.  
Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS.  
This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control  
frames in order to break the max concurrent streams limit - which results in resource  
exhaustion and distributed denial of service.  

This issue has been patched in versions 4.1.124.Final and 4.2.4.Final.

@DerGuteMoritz
Copy link
Collaborator

Thanks a lot! I'll tag a new release by tomorrow!

@DerGuteMoritz DerGuteMoritz merged commit 56e3075 into clj-commons:master Aug 20, 2025
1 check passed
@ivo-vachkov
Copy link
Author

tomorrow

Thank you!
It's the least I can do!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants