HTTP/2 ‘MadeYouReset’ Vulnerability Enable Denial-of-Service (DoS) Attacks

A critical vulnerability across many HTTP/2 implementations, known as MadeYouReset and tracked as CVE-2025-8671, enables threat actors to orchestrate denial-of-service and distributed denial-of-service attacks by abusing server-sent stream resets. Security researchers from Tel Aviv University—Gal Bar Nahum, Anat Bremler-Barr, and Yaniv Harel—discovered the flaw, which arises from a mismatch between the HTTP/2 specification and real-world server implementations.

The exploit relies on attackers rapidly triggering server resets, causing the protocol to treat reset streams as closed while backend servers continue processing requests, leading to severe resource exhaustion. The advisory notes that numerous major vendors and projects are affected, with Apache Tomcat receiving CVE-2025-48989 to describe its implementation of the vulnerability.

According to CERT/CC, vendors should implement stricter limits on RST_STREAM frames and review HTTP/2 implementations, and organisations should prioritise patching while considering additional rate-limiting on reset frames. This vulnerability’s DDoS potential has already prompted patches and statements from affected vendors, and the article urges immediate action to mitigate risk.