[CVE-2025-55163] HIGH: grpc-netty-shaded / netty-codec-http2 - HTTP/2 DDoS vulnerability

[nthmost-orkes]

Vulnerability Report

Field	Value
CVE	CVE-2025-55163
Severity	HIGH
Libraries	io.grpc:grpc-netty-shaded (1.70.0), io.netty:netty-codec-http2 (4.1.118.Final)
Source	workers.jar
Fixed Versions	grpc-netty-shaded 1.75.0, netty-codec-http2 4.2.4.Final / 4.1.124.Final

Summary

Netty MadeYouReset HTTP/2 DDoS Vulnerability - affects both grpc-netty-shaded and netty-codec-http2.

References

• NVD Entry

---

Filed from container vulnerability scan of workers.jar

[nthmost-orkes]

Fix PRs:

• Bump gRPC from 1.57.2 to 1.70.0 conductor-task-update#2 (gRPC 1.57.2 -> 1.70.0, updates netty transitively)
• conductor repo already at gRPC 1.73.0 — no change needed there