The vulnerability CVE-2025-55163 affects Netty's HTTP/2 implementation in Red Hat OpenShift AI 2.25.0 and later. Malformed client requests can trigger server-side stream resets without incrementing abuse counters, enabling attackers to repeatedly cause server resource exhaustion by bypassing built-in throttling mechanisms. This results in excessive CPU and memory consumption, potentially causing denial of service. The flaw is an implementation weakness (CWE-770) rather than a protocol bug. Red Hat has not yet provided a fix or usable mitigation for this issue.

An attacker can remotely cause denial of service by exhausting server CPU and memory resources through repeated malformed HTTP/2 requests that trigger server-side stream resets without detection by abuse counters. This can degrade or disrupt service availability for legitimate clients. No confidentiality or integrity impacts are reported. The vulnerability is rated with high availability impact and low complexity to exploit without authentication or user interaction.

No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability. Users should monitor Red Hat advisories for updates and apply any future patches or recommended configuration changes once available. Until then, consider limiting exposure of affected services to untrusted networks if possible.