Security update for netty SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2025:03021-1 Final 1 1 2025-08-29T09:42:17Z current 2025-08-29T09:42:17Z 2025-08-29T09:42:17Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for netty This update for netty fixes the following issues: - CVE-2025-55163: Fixed 'MadeYouReset' DoS attack in HTTP/2 protocol (including DNS over HTTPS) (bsc#1247991) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2025-3021,SUSE-SLE-Product-SUSE-Manager-Server-4.3-LTS-2025-3021 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2025/suse-su-202503021-1/ Link for SUSE-SU-2025:03021-1 https://lists.suse.com/pipermail/sle-updates/2025-August/041418.html E-Mail link for SUSE-SU-2025:03021-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1247991 SUSE Bug 1247991 https://www.suse.com/security/cve/CVE-2025-55163/ SUSE CVE CVE-2025-55163 page SUSE Manager Server LTS 4.3 netty-4.1.44.Final-150400.3.9.1 netty-4.1.44.Final-150400.3.9.1 as a component of SUSE Manager Server LTS 4.3 Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service. This issue has been patched in versions 4.1.124.Final and 4.2.4.Final. CVE-2025-55163 SUSE Manager Server LTS 4.3:netty-4.1.44.Final-150400.3.9.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503021-1/ https://www.suse.com/security/cve/CVE-2025-55163.html CVE-2025-55163 https://bugzilla.suse.com/1243888 SUSE Bug 1243888 https://bugzilla.suse.com/1244252 SUSE Bug 1244252 https://bugzilla.suse.com/1247991 SUSE Bug 1247991