Denial-of-Service via HTTP/2: MadeYouReset Vulnerability Bypasses Rapid Reset Mitigations

A new vulnerability dubbed “MadeYouReset” impacts multiple HTTP/2 server implementations, enabling large-scale Denial-of-Service (DoS) attacks. It bypasses traditional limits set on concurrent HTTP/2 requests per TCP connection, enabling attackers to overwhelm target servers and even trigger out-of-memory crashes. The flaw stems from a protocol misuse involving RST_STREAM frames — an evolution of previously known Rapid Reset attacks.

Severity Level: High

Vulnerability Details

• ID: CVE-2025-8671 (with specific CVEs per vendor implementation)
• Class: Denial-of-Service (DoS)
• Affected Protocol: HTTP/2
• Related Prior CVE: CVE-2023-44487 (Rapid Reset)
• The root cause lies in the incorrect handling of RST_STREAM frames:
  • When a stream is reset, it’s counted as closed per HTTP/2 spec.
  • However, many server implementations continue processing the backend request.
  • The SETTINGS_MAX_CONCURRENT_STREAMS parameter in HTTP/2 is bypassed since reset streams are no longer counted.
  • Attackers exploit this by triggering resets via malformed frames or flow control violations, effectively creating resource leaks.

Exploitation

• Open valid HTTP/2 streams from a client to the server.
• Send crafted malformed control frames (e.g., invalid WINDOW_UPDATE, PRIORITY, DATA, HEADERS) to force server-initiated stream resets.
• The server sends RST_STREAM but continues backend processing.
• Since the protocol considers these streams closed, the attacker can repeat this process indefinitely.
• The result is DoS via CPU overload or memory exhaustion.

Recommendations

1. Apply security updates provided by vendors (Apache, F5, Netty, etc.) addressing CVE-2025-8671 and related CVEs.
2. Indicators of attack for BIG-IP systems:
   For BIG-IP systems, you can inspect the HTTP/2 profile statistics. If the number of RST_STREAM frames Sent and WINDOW_UPDATE frames Received significantly exceeds the number of other frames received from clients, this may indicate that a malicious actor is conducting this type of attack.
   If there is no impact on the CPU load of the BIG-IP system, you may not need to take remedial action; however, if a significant or troublesome increase in CPU load is observed, download and install the engineering hotfix for this issue.
   For information about how to view the HTTP/2 profile statistics using the Configuration utility, tmsh, or SNMP, refer to K000137190: Overview of HTTP/2 Statistics.

Source:

• https://thehackernews.com/2025/08/new-http2-madeyoureset-vulnerability.html
• https://kb.cert.org/vuls/id/767506
• https://lists.apache.org/thread/9ydfg0xr0tchmglcprhxgwhj0hfwxlyf
• https://my.f5.com/manage/s/article/K000152001
• https://github.com/netty/netty/security/advisories/GHSA-prj3-ccx8-p6x4
• https://www.fastlystatus.com/incident/377810

Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn

No related posts found.