conductor-oss / conductor-oss/java-sdk
[CVE-2025-55163] HIGH: grpc-netty-shaded / netty-codec-http2 - HTTP/2 DDoS vulnerability
Open
security
vulnerability
- Dominant language
- Java
- Stars
- 12
- Forks
- 10
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 4
Description
## Vulnerability Report
| Field | Value |
|-------|-------|
| **CVE** | `CVE-2025-55163` |
| **Severity** | **HIGH** |
| **Libraries** | `io.grpc:grpc-netty-shaded` (1.70.0), `io.netty:netty-codec-http2` (4.1.118.Final) |
| **Source** | `workers.jar` |
| **Fixed Versions** | grpc-netty-shaded 1.75.0, netty-codec-http2 4.2.4.Final / 4.1.124.Final |
### Summary
Netty MadeYouReset HTTP/2 DDoS Vulnerability - affects both grpc-netty-shaded and netty-codec-http2.
### References
- [NVD Entry](https://avd.aquasec.com/nvd/cve-2025-55163)
---
*Filed from container vulnerability scan of `workers.jar`*
Contributor guide
Assessment
This issue has not been assessed yet.