USN-8654-1: Netty vulnerabilities

unknownCVE-2025-55163 CVE-2025-67735

It was discovered that Netty did not properly handle malformed HTTP/2 control frames. An attacker could use this to cause a denial of service via resource exhaustion. This issue only affects Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2025-55163) It was discovered that Netty did not properly validate the request URI for line-break characters. An attacker could use this to perform CRLF injection and request smuggling. (CVE-2025-67735)

CSIRTS triage

vendor: Netty product: Netty Denial of service Code injection

What: Improper handling of malformed HTTP/2 control frames (CVE-2025-55163) and failure to validate request URI for line-break characters enabling CRLF injection (CVE-2025-67735).
Who is affected: Ubuntu 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS systems using Netty; also any HTTP/2 deployments vulnerable to request smuggling.
Urgency: High; DOS via resource exhaustion and request smuggling are active attack vectors.
Action: Apply USN-8654-1 update for Netty.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Netty

Get an email when a new Netty advisory drops — max one per day, one-click unsubscribe.

Details

Source: Ubuntu Security Notices (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-08-20
Exploitation: Not in CISA KEV at last sync

Original advisory: https://ubuntu.com/security/notices/USN-8654-1

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Moderate exploitation riskCVE-2025-551631.0% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 62% of all EPSS-scored CVEs.
Low exploitation riskCVE-2025-677350.33% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 25% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2025-55163	coverage & exploitation status	NVD · CVE.org
CVE-2025-67735	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

criticalexploited[UPDATE] [critical] Oracle Fusion Middleware: Multiple Vulnerabilitiescert-bund
medium[UPDATE] [medium] Keycloak (netty-codec-http): Vulnerability allows file manipulationcert-bund