CVE-2025-8671: CVE-2025-8671
Description
A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Tracked companies
Mapped from the CVE’s affected-product data, NVD CPE matches, vendor advisories or package feeds. A mapping means the vendor’s software is named, not that its hosted service was exposed.
Status incidents that name it
No tracked status incident names this CVE.
Affected vendors and products
Fastly: H20SUSE Linux: Enterprise DesktopSUSE Linux: Enterprise High Performance ComputingSUSE Linux: Enterprise High Performance Computing (HPC)SUSE Linux: Enterprise Module for Development ToolsSUSE Linux: Enterprise Module for Dev ToolsSUSE Linux: Enterprise Module for Package HubSUSE Linux: Enterprise ServerSUSE Linux: Enterprise Server for SAP ApplicationsSUSE Linux: openSUSE LeapSUSE Linux: SUSE Manager ProxySUSE Linux: SUSE Manager Retail Branch ServerSUSE Linux: SUSE Manager ServerSUSE Linux: SUSE Manager Server LTSVarnish Software: Varnish CacheVarnish Software: Varnish EnterpriseWind River: Linux
References
- CVE record on cve.org (opens in new tab)
- NVD entry (opens in new tab)
- galbarnahum.com/made-you-reset (opens in new tab)
- github.com/h2o/h2o/commit/4729b661e3c6654198d2cc62997e1af58bef4b80 (opens in new tab)
- github.com/h2o/h2o/security/advisories/GHSA-mrjm-qq9m-9mjq (opens in new tab)
- gitlab.isc.org/isc-projects/bind9/-/issues/5325 (opens in new tab)
- kb.cert.org/vuls/id/767506 (opens in new tab)
- support2.windriver.com/index.php (opens in new tab)
- varnish-cache.org/security/VSV00017.html (opens in new tab)
- www.fastlystatus.com/incident/377810 (opens in new tab)
- www.suse.com/support/kb/doc/ (opens in new tab)
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)