New HTTP/2 ‘MadeYouReset’ Vulnerability Enables Large-Scale DoS Attacks

New HTTP/2 ‘MadeYouReset’ Vulnerability Enables Large-Scale DoS Attacks

Multiple HTTP/2 implementations are vulnerable to the MadeYouReset attack, which can cause severe denial-of-service conditions and server crashes. This vulnerability impacts several products and builds upon previous protocol exploits, highlighting the ongoing threats to web server security. #CVE-2025-8671 #ApacheTomcat #F5BIG-IP #Netty

Keypoints

  • The MadeYouReset attack bypasses the request limits in HTTP/2, enabling thousands of requests and potential server crashes.
  • This vulnerability exploits the misuse of the RST_STREAM frame to trigger protocol violations and resource exhaustion.
  • The attack impacts multiple products such as Apache Tomcat, F5 BIG-IP, and Netty, all assigned specific CVE identifiers.
  • MadeYouReset can completely bypass mitigations like Rapid Reset, increasing the severity of potential DoS attacks.
  • Security experts emphasize the importance of protecting HTTP/2 implementations due to their foundational role in web infrastructure.

Read More: https://thehackernews.com/2025/08/new-http2-madeyoureset-vulnerability.html