CVE-2025-8671

Published Aug 13, 2025

Last updated 6 days ago

MadeYouReset

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-8671, also known as "MadeYouReset," is an HTTP/2 denial-of-service (DoS) vulnerability that exploits a mismatch in how some HTTP/2 implementations handle server-sent stream resets. Discovered by researchers from Tel Aviv University and Imperva, the vulnerability arises because certain servers incorrectly treat these resets as stream closures. An attacker can trigger these resets using crafted HTTP/2 frames, such as malformed WINDOW_UPDATE or PRIORITY frames. By rapidly triggering server-side resets, an attacker can cause the server to handle an unbounded number of concurrent streams on a single connection, bypassing the standard `MAX_CONCURRENT_STREAMS` limit. This leads to excessive consumption of server resources, potentially causing a denial-of-service condition due to memory or processing capability exhaustion. Affected implementations include Apache Tomcat, F5 BIG-IP, Netty, and others.

Description: A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.
Source: cret@cert.org
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity: HIGH

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-404

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 1

References