Resource exhaustion in Netty - CVE-2025-55163

Vulnerability identifier: #VU114026

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-55163

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when handling HTTP/2 requests. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Netty
SUSE Manager Server 4.3
Debian Linux
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Server
SUSE Enterprise Storage
Development Tools Module
SUSE Package Hub 15
openSUSE Leap
Ubuntu
IBM Operator for Apache Flink
IBM Concert Software
IBM Observability with Instana
Oracle Communications Converged Charging System
IBM Decision Optimization for Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
Crowd Data Center
Oracle Communications Unified Inventory Management
Bamboo Server
Jira Software Data Center
Jira Service Management Data Center
Jira Service Management Server
Service Delivery Platform
IBM Cloud Pak for Business Automation
Oracle Communications Network Analytics Data Director
Oracle Communications Cloud Native Core Binding Support Function
Oracle Communications Cloud Native Core Network Repository Function
Red Hat build of Quarkus
Red Hat OpenShift Dev Spaces
Bitbucket Data Center
Event Processing
Astronomer with IBM
Netezza Appliance
Oracle Utilities Network Management System
Guardium Data Security Center (GDSC)
DataStage on Cloud Pak for Data
Maximo Application Suite - Monitor Component
IBM Business Automation Manager Open Editions
Oracle Communications Network Charging and Control
Oracle Data Integrator
Oracle Retail Xstore Point of Service
webMethods Managed File Transfer
Guardium Data Protection
watsonx.data
IBM Cloud Pak System
Communications Unified Assurance
Communications Service Catalog and Design
Oracle Communications Billing and Revenue Management
Oracle Communications Offline Mediation Controller
JBoss Enterprise Application Platform
Oracle Coherence
AMQ Streams
Bitbucket Server
Crowd Server
Oracle Communications Order and Service Management
PeopleSoft Enterprise PeopleTools
Operational Decision Manager
Jira Software Server
JBoss Data Grid
Oracle Commerce Guided Search
Oracle Banking Payments
IBM DB2
Oracle Communications Pricing Design Center
Oracle Hospitality Cruise Shipboard Property Management System
Oracle Banking Trade Finance Process Management
Oracle Banking Virtual Account Management
Oracle Banking Branch
Oracle Banking Cash Management
Oracle Banking Supply Chain Finance
Oracle Banking Liquidity Management
Oracle Banking Origination
Oracle Communications Cloud Native Core Policy
Oracle Communications Cloud Native Core Network Slice Selection Function
Oracle Communications Cloud Native Core Network Function Cloud Native Environment
Oracle Communications Cloud Native Core Unified Data Repository
Oracle Communications Cloud Native Core Security Edge Protection Proxy
eap7-undertow (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
netty-tcnative
netty-tcnative-javadoc
netty-tcnative-debugsource
eap7-jackson-annotations (Red Hat package)
eap7-jackson-modules-java8 (Red Hat package)
eap7-jackson-module-jaxb-annotations (Red Hat package)
eap7-jackson-jaxrs-providers (Red Hat package)
eap7-jackson-core (Red Hat package)
eap7-jackson-databind (Red Hat package)
eap7-jackson-modules-base (Red Hat package)
eap8-wss4j (Red Hat package)
eap8-xml-security (Red Hat package)
eap8-apache-commons-lang (Red Hat package)
eap8-apache-cxf (Red Hat package)
netty (Ubuntu package)
eap8-apache-cxf-xjc-utils (Red Hat package)
netty
netty (Debian package)
eap7-netty (Red Hat package)
netty-javadoc
eap8-netty-transport-native-epoll (Red Hat package)
eap8-netty (Red Hat package)
eap8-opensaml (Red Hat package)
eap7-wildfly (Red Hat package)
eap8-jbossws-cxf (Red Hat package)
eap8-wildfly (Red Hat package)
eap8-eap-product-conf-parent (Red Hat package)
Red Hat Camel for Spring Boot
Splunk AppDynamics Analytics Agent

Install updates from vendor's website.

Netty - addressed in versions 4.1.124, 4.2.4
IBM Operator for Apache Flink - update to 1.4.5
Event Processing - update to 1.4.5
Astronomer with IBM - update to 1.1.0
IBM Concert Software - update to 2.2.0
Netezza Appliance - update to 1.0.0.1
IBM Observability with Instana - update to 1.0.308
watsonx.data - update to 2.2.2
IBM Cloud Pak System - update to 2.3.5.1
Guardium Data Security Center (GDSC) - update to 3.8.5
IBM Decision Optimization for Cloud Pak for Data - update to 5.2.2
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.3.0
DataStage on Cloud Pak for Data - update to 5.2.2
JBoss Enterprise Application Platform - addressed in versions 7.1.13, 7.3.16, 8.0.9, 8.1.0
Crowd Data Center - update to 7.1.1
Crowd Server - update to 7.1.1
Maximo Application Suite - Monitor Component - addressed in versions 8.10.25, 8.11.23, 9.0.15, 9.1.5
IBM Business Automation Manager Open Editions - update to 9.3.1
Bamboo Server - addressed in versions 9.6.19, 10.2.8
Jira Software Data Center - update to 9.12.28
Jira Software Server - update to 9.12.28
Jira Service Management Data Center - addressed in versions 10.3.12, 11.1.0
Jira Service Management Server - addressed in versions 10.3.12, 11.1.0
IBM Cloud Pak for Business Automation - addressed in versions 24.0.0-IF007, 24.0.1-IF006, 25.0.0-IF003
eap7-undertow (Red Hat package) - addressed in versions 1.4.18-18.SP16_redhat_00001.1.ep7.el7, 2.0.41-6.SP7_redhat_00001.1.el7eap
eap7-jboss-server-migration (Red Hat package) - update to 1.7.2-20.Final_redhat_00021.1.el7eap
netty-tcnative - update to 2.0.73-150200.3.30.1
netty-tcnative-javadoc - update to 2.0.73-150200.3.30.1
netty-tcnative-debugsource - update to 2.0.73-150200.3.30.1
eap7-jackson-annotations (Red Hat package) - addressed in versions 2.8.11-2.redhat_00004.1.ep7.el7, 2.10.4-4.redhat_00008.1.el7eap
eap7-jackson-modules-java8 (Red Hat package) - addressed in versions 2.8.11-2.redhat_00004.1.ep7.el7, 2.10.4-3.redhat_00008.1.el7eap
eap7-jackson-module-jaxb-annotations (Red Hat package) - update to 2.8.11-3.redhat_00004.1.ep7.el7
eap7-jackson-jaxrs-providers (Red Hat package) - addressed in versions 2.8.11-3.redhat_00004.1.ep7.el7, 2.10.4-4.redhat_00008.1.el7eap
eap7-jackson-core (Red Hat package) - addressed in versions 2.8.11-3.redhat_00004.1.ep7.el7, 2.10.4-4.redhat_00008.1.el7eap
eap7-jackson-databind (Red Hat package) - update to 2.10.4-6.redhat_00008.1.el7eap
eap7-jackson-modules-base (Red Hat package) - update to 2.10.4-6.redhat_00008.1.el7eap
eap8-wss4j (Red Hat package) - addressed in versions 3.0.4-1.redhat_00002.1.el8eap, 3.0.4-1.redhat_00002.1.el9eap
eap8-xml-security (Red Hat package) - addressed in versions 3.0.5-1.redhat_00001.1.el8eap, 3.0.5-1.redhat_00001.1.el9eap
AMQ Streams - update to 3.1.0
Red Hat build of Quarkus - addressed in versions 3.15.6.SP1, 3.20.2.SP1
eap8-apache-commons-lang (Red Hat package) - addressed in versions 3.18.0-1.redhat_00002.1.el8eap, 3.18.0-1.redhat_00002.1.el9eap
Red Hat OpenShift Dev Spaces - update to 3.24.0
eap8-apache-cxf (Red Hat package) - addressed in versions 4.0.9-4.redhat_00002.1.el8eap, 4.0.9-4.redhat_00002.1.el9eap, 4.0.9-5.redhat_00002.1.el8eap, 4.0.9-5.redhat_00002.1.el9eap
netty (Ubuntu package) - addressed in versions 1:4.0.34-1ubuntu0.1~esm5, 1:4.1.7-4ubuntu0.1+esm7, 1:4.1.45-1ubuntu0.1~esm7, 1:4.1.48-4+deb11u2ubuntu0.2, 1:4.1.48-9ubuntu0.2
eap8-apache-cxf-xjc-utils (Red Hat package) - addressed in versions 4.1.0-1.redhat_00001.1.el8eap, 4.1.0-1.redhat_00001.1.el9eap
netty - addressed in versions 4.1.44.Final-150400.3.9.1, 4.1.126-150200.4.34.1
netty (Debian package) - addressed in versions 1:4.1.48-7+deb12u2, 1:4.1.48-10+deb13u1
eap7-netty (Red Hat package) - addressed in versions 4.1.63-3.Final_redhat_00004.1.ep7.el7, 4.1.63-6.Final_redhat_00004.1.el7eap
netty-javadoc - update to 4.1.126-150200.4.34.1
eap8-netty-transport-native-epoll (Red Hat package) - addressed in versions 4.1.127-1.Final_redhat_00001.1.el8eap, 4.1.127-1.Final_redhat_00001.1.el9eap
eap8-netty (Red Hat package) - addressed in versions 4.1.127-1.Final_redhat_00001.1.el8eap, 4.1.127-1.Final_redhat_00001.1.el9eap
eap8-opensaml (Red Hat package) - addressed in versions 4.3.2-2.redhat_00002.1.el8eap, 4.3.2-2.redhat_00002.1.el9eap
Red Hat Camel for Spring Boot - addressed in versions 4.10, 4.10.6
eap7-wildfly (Red Hat package) - addressed in versions 7.1.13-6.GA_redhat_00002.1.ep7.el7, 7.3.16-3.GA_redhat_00003.1.el7eap
eap8-jbossws-cxf (Red Hat package) - addressed in versions 7.3.4-1.Final_redhat_00001.1.el8eap, 7.3.4-1.Final_redhat_00001.1.el9eap
eap8-wildfly (Red Hat package) - addressed in versions 8.0.9-8.GA_redhat_00008.1.el8eap, 8.0.9-8.GA_redhat_00008.1.el9eap, 8.1.0-55.GA_redhat_00016.1.el8eap, 8.1.0-55.GA_redhat_00016.1.el9eap
JBoss Data Grid - update to 8.5.5
Operational Decision Manager - addressed in versions 8.11.0.1 Interim fix 49, 8.11.1 Interim fix 47, 8.12.0.1 Interim fix 31, 9.0.0.1 Interim fix 15, 9.5.0.0 Interim fix 7
Bitbucket Server - addressed in versions 9.4.13, 10.0.2
Bitbucket Data Center - addressed in versions 9.4.13, 10.0.2
webMethods Managed File Transfer - update to 11.1 Server Fix2
Guardium Data Protection - update to 12.0p50
Splunk AppDynamics Analytics Agent - update to 26.1.0
eap8-eap-product-conf-parent (Red Hat package) - addressed in versions 800.9.1-3.GA_redhat_00004.1.el8eap, 800.9.1-3.GA_redhat_00004.1.el9eap, 801.0.1-2.GA_redhat_00003.1.el8eap, 801.0.1-2.GA_redhat_00003.1.el9eap

• https://github.com/netty/netty/security/advisories/GHSA-prj3-ccx8-p6x4

• HTTP/2 Made You Reset Attack in Netty
• Resource exhaustion in Red Hat build of Quarkus 3.15.6
• Resource exhaustion in Red Hat build of Quarkus 3.20.2
• Resource exhaustion in Red Hat Camel for Spring Boot 4
• Multiple vulnerabilities in Red Hat Camel for Spring Boot 4.10
• SUSE update for netty
• SUSE update for netty, netty-tcnative
• Resource exhaustion in JBoss Data Grid 8.5
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Unified Data Repository
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Policy
• Multiple vulnerabilities in Oracle Communications Unified Inventory Management
• Multiple vulnerabilities in Oracle Communications Billing and Revenue Management
• Multiple vulnerabilities in Oracle Communications Offline Mediation Controller
• Multiple vulnerabilities in Oracle Communications Order and Service Management
• Multiple vulnerabilities in Oracle Communications Network Charging and Control
• Multiple vulnerabilities in Oracle Communications Converged Charging System
• Multiple vulnerabilities in Oracle Commerce Guided Search
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Binding Support Function
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Slice Selection Function
• Multiple vulnerabilities in Communications Service Catalog and Design
• Resource exhaustion in Oracle Communications Pricing Design Center
• Multiple vulnerabilities in Oracle Banking Branch
• Resource exhaustion in Oracle Coherence
• Multiple vulnerabilities in Oracle Hospitality Cruise Shipboard Property Management System
• Multiple vulnerabilities in Oracle Retail Xstore Point of Service
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 8.0
• IBM DataStage on Cloud Pak for Data update for Netty
• Multiple vulnerabilities in Red Hat OpenShift Dev Spaces
• Bitbucket Data Center and Server update for Netty
• Multiple vulnerabilities in IBM Decision Optimization for Cloud Pak for Data
• Multiple vulnerabilities in IBM Operational Decision Manager
• Multiple vulnerabilities in IBM Observability with Instana
• Multiple vulnerabilities in IBM Guardium Data Security Center
• IBM watsonx.data update for Netty
• Jira Software Data Center and Server update for Netty
• Red Hat AMQ Streams update for Apache Kafka
• IBM Netezza Appliance update for Netty
• Multiple vulnerabilities in IBM webMethods Managed File Transfer
• Jira Service Management Data Center and Server update for netty-codec-http2
• Crowd Data Center and Server update for netty-codec-http2
• Multiple vulnerabilities in IBM Event Processing
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.1
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• IBM Maximo Application Suite - Monitor Component update for Netty
• Multiple vulnerabilities in Communications Unified Assurance
• Multiple vulnerabilities in Oracle Communications Network Analytics Data Director
• Multiple vulnerabilities in Oracle Data Integrator
• Resource exhaustion in Service Delivery Platform
• Multiple vulnerabilities in Oracle Banking Liquidity Management
• Multiple vulnerabilities in Oracle Banking Supply Chain Finance
• Multiple vulnerabilities in Oracle Banking Cash Management
• Multiple vulnerabilities in PeopleSoft Enterprise PeopleTools
• Resource exhaustion in Oracle Utilities Network Management System
• Astronomer with IBM update for Netty
• Bamboo Data Center and Server update for io.netty:netty-codec-http2
• Multiple vulnerabilities in IBM Db2
• IBM Watson Discovery Cartridge update for Netty
• Multiple vulnerabilities in IBM Concert Software
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.3
• Multiple vulnerabilities in IBM Operator for Apache Flink
• Multiple vulnerabilities in IBM Guardium Data Protection
• Debian update for netty
• Splunk AppDynamics Analytics Agent update for third-party components
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in Oracle Banking Virtual Account Management
• Resource exhaustion in Oracle Banking Payments
• Multiple vulnerabilities in Oracle Banking Origination
• Multiple vulnerabilities in Oracle Banking Trade Finance Process Management
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Function Cloud Native Environment
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Security Edge Protection Proxy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Repository Function
• Multiple vulnerabilities in IBM Cloud Pak System
• Ubuntu update for netty