New HTTP/2 Denial of Service Vulnerability: Understanding the Threat

A recent vulnerability in the HTTP/2 protocol has emerged, bringing to light significant security risks that have drawn attention from researchers and cybersecurity professionals alike. Identified as CVE-2025-8671, this new denial of service (DoS) flaw poses a serious challenge to various unpatched server implementations. Insights from an academic team at Tel Aviv University reveal that they have been proactive in working with affected vendors to address this issue since May 2023.

What is CVE-2025-8671?

The vulnerability was publicly announced on August 13, 2023, and the findings highlight the ability of an attacker to manipulate server workload effectively. According to researchers Gal Bar Nahum, Anat Bremler‑Barr, and Yaniv Harel, the flaw allows an attacker to bypass built-in concurrency limits in HTTP/2. This can lead to a denial of service condition on the affected servers, significantly degrading their performance.

The Flaw Explained

Building on the vulnerabilities associated with the “Rapid Reset” discovered earlier in 2023, CVE-2025-8671 introduces a new method for launching attacks. The Rapid Reset vulnerability leveraged HTTP/2’s request cancellation mechanism. This flaw permitted malicious users to open and cancel streams immediately using RST_STREAM, thus evading the default limit on active streams set at 100.

The researchers pointed out that the common mitigation applied to combat the Rapid Reset was relatively simple: limit the number of streams a client can cancel. However, the researchers have discovered an alternative strategy—calling it “MadeYouReset”—which effectively circumvents this mitigation. By causing the server to cancel requests instead of the client, attackers can generate unbounded concurrent work.

Technical Intricacies

In their research, the team identified specific control frames that could be exploited, allowing the server to send RST_STREAM commands under particular conditions. This manipulation involves several forms of frames including WINDOW_UPDATE, PRIORITY, HEADERS, and DATA frames. These intricacies underscore the complex nature of HTTP/2 and the subtleties that attackers can exploit.

Vendor Responses to the Vulnerability

In response to the MadeYouReset flaw, prominent vendors like Cloudflare and Akamai have reported that their HTTP/2 implementations do not exhibit vulnerabilities related to CVE-2025-8671, classifying it under improper resource shutdown or release vulnerabilities (CWE-404).

Furthermore, the Carnegie Mellon CERT Coordination Center has identified a variety of vendors and projects impacted by this new vulnerability. Many of these entities, such as Apache Tomcat, F5, Fastly, h2o, Netty, and IBM WebSphere Application Server Liberty, have already begun rolling out fixes and mitigations to safeguard against potential attacks.

Broader Security Implications

The emergence of the MadeYouReset vulnerability occurs alongside other significant security concerns in web protocols, as highlighted by PortSwigger’s recent research on HTTP/1.1. This collective threat landscape emphasizes the importance of ongoing vigilance and collaboration within the cybersecurity community.

As vendors and developers work hard to patch their systems, the evolving nature of these vulnerabilities serves as a reminder of the constant challenges faced in maintaining secure network environments. Cybersecurity remains an ever-pressing issue, and understanding the nuances of such vulnerabilities is essential for businesses and web services that rely on these protocols.