New HTTP/2 'Made YouReset' Vulnerability Enables Large-Scale DoS Attacks
Summary: Researchers Gal Bar Nahum, Anat Bremler-Barr, and Yaniv Harel found that MadeYouReset bypasses the typical server-imposed limit of 100 concurrent HTTP/2 requests per TCP connection, letting an attacker send many thousands of requests and, in some vendor implementations, escalate to out-of-memory crashes. The flaw carries the generic identifier CVE-2025-8671 (CVSS 7.5) and affects products including Apache Tomcat (CVE-2025-48989), F5 BIG-IP (CVE-2025-54500), and Netty (CVE-2025-55163).
What's compelling: MadeYouReset needs no RST_STREAM frame from the attacker, so it completely bypasses the Rapid Reset mitigations many teams already deployed after CVE-2023-44487 - the same impact, with the defense you bought last time doing nothing.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2023-44487CVE-2025-32094CVE-2025-4366CVE-2025-48989CVE-2025-54500CVE-2025-55163CVE-2025-8671
- Related
- CVE-2023-44487: HTTP/2 Rapid Reset Attack Vulnerability Known Exploited Vulnerabilities · Oct 10, 2023Top resources for Cybersecurity Awareness Month Cyber Risks ·Patch Tuesday, October 2023 Edition Cyber Risks ·