conductor-oss / conductor-oss/java-sdk
[CVE-2025-55163] HIGH: grpc-netty-shaded / netty-codec-http2 - HTTP/2 DDoS vulnerability
Aperta
security
vulnerability
- Lingua principale
- Java
- Stelle
- 12
- Fork
- 10
- Merge medio
- 2g 8h
- PR unite (30g)
- 4
Descrizione
## Vulnerability Report
| Field | Value |
|-------|-------|
| **CVE** | `CVE-2025-55163` |
| **Severity** | **HIGH** |
| **Libraries** | `io.grpc:grpc-netty-shaded` (1.70.0), `io.netty:netty-codec-http2` (4.1.118.Final) |
| **Source** | `workers.jar` |
| **Fixed Versions** | grpc-netty-shaded 1.75.0, netty-codec-http2 4.2.4.Final / 4.1.124.Final |
### Summary
Netty MadeYouReset HTTP/2 DDoS Vulnerability - affects both grpc-netty-shaded and netty-codec-http2.
### References
- [NVD Entry](https://avd.aquasec.com/nvd/cve-2025-55163)
---
*Filed from container vulnerability scan of `workers.jar`*
Guida per i contributori
Apri la guida per i contributori
Valutazione
Questa issue non è ancora stata valutata.