MadeYouReset (CVE-2025-8671): New HTTP/2 DoS Vulnerability Bypasses Rapid Reset Defenses

The short version

A fresh HTTP/2 protocol bug, nicknamed "MadeYouReset" and tracked as CVE-2025-8671, lets attackers run high-volume denial-of-service (DoS) attacks that walk straight past the defenses vendors built for the earlier Rapid Reset flaw (CVE-2023-44487).

The root cause is how several HTTP/2 implementations mishandle RST_STREAM frames. When a stream gets reset, these servers are supposed to stop working on it. They don't. They keep processing the request anyway. That breaks the SETTINGS_MAX_CONCURRENT_STREAMS safeguard, so an attacker can open effectively unlimited streams and grind resources down to nothing.

What it costs you: CPU exhaustion, memory leaks, application instability, and crashes.

I've spent years writing proof-of-concept DoS tooling against web stacks, and what makes this class of bug so frustrating is that the "fix" for Rapid Reset assumed clients initiate the resets. MadeYouReset flips that assumption on its head.

---

Vulnerability at a glance

Field	Value
CVE ID	CVE-2025-8671 (plus vendor-specific CVEs)
Class	Denial-of-Service (DoS)
Protocol	HTTP/2
Related CVE	CVE-2023-44487 (Rapid Reset)
Impact	CPU/memory exhaustion → service downtime
Prerequisites	Remote access to HTTP/2 endpoints

---

Who's affected, and where the fixes are

Vendor / Product	CVE ID	Affected Versions	Fixed Versions / Mitigations
Apache Tomcat	CVE-2025-48989	11.0.0-M1 → 11.0.9; 10.1.0-M1 → 10.1.43; 9.0.0.M1 → 9.0.107	11.0.10+, 10.1.44+, 9.0.108+
F5 BIG-IP	CVE-2025-54500	Next (20.3.0), SPK 2.0.0–2.0.2, CNF 2.0.0–2.0.2, K8s 2.0.0, BIG-IP 17.5.0–17.5.1, 17.1.0–17.1.2, 16.1.0–16.1.6, 15.1.0–15.1.10	Hotfixes available; mitigation: disable HTTP/2 or remove F5SPKIngressHTTP2
Netty	CVE-2025-55163	netty-codec-http2 ≤ 4.2.3.Final, ≤ 4.1.123.Final	Patched in 4.2.4.Final, 4.1.124.Final
Fastly (H2O fork)	CVE-2025-8671	Releases < 25.17	Fixed in release 25.17

---

How the attack actually runs

Here's the chain an attacker uses to pull off MadeYouReset:

1. Open valid HTTP/2 streams.
2. Send crafted frames (WINDOW_UPDATE, PRIORITY, DATA, HEADERS).
3. Trigger server-initiated RST_STREAM responses.
4. Lean on the broken implementations where the backend still processes canceled requests.
5. Repeat without limit to pile on CPU and memory load until the service slows or crashes.

That's the whole trick. The server resets the stream, thinks it's done, and quietly keeps churning. Stack enough of those together and you've sidestepped Rapid Reset protections entirely and parked a persistent DoS on the target.

---

What to watch for

For F5 BIG-IP and other HTTP/2 platforms, keep an eye on:

• Large volumes of RST_STREAM (sent) paired with WINDOW_UPDATE (received).
• Red flags worth alerting on:
  • Reset streams climbing fast relative to legitimate requests
  • CPU spikes that don't line up with actual traffic volume

If the CPU impact stays minimal, keep monitoring. If consumption jumps, apply the hotfix or patch right away. The same blind spot that makes this exploitable is the same telemetry gap that hides slow lateral abuse — which is exactly why we built credential mines that survive EDR-killer tooling around the assumption that monitoring alone isn't enough.

---

What you should do

• Patch or hotfix now:

  • Apache → 11.0.10+, 10.1.44+, 9.0.108+
  • Netty → 4.2.4.Final or 4.1.124.Final
  • F5 BIG-IP → vendor hotfixes
  • Fastly → release 25.17

• Buy time if you can't patch yet:

  • Disable HTTP/2 and fall back to HTTP/1.1.
  • Add rate-limiting and anomaly detection for HTTP/2 traffic.

• Watch the protocol layer:

  • Track RST_STREAM abuse and resource spikes.
  • Audit for CPU/memory exhaustion tied to HTTP/2 streams.

• Weigh the blast radius:

  • Figure out your downtime risk if you run infrastructure that leans heavily on HTTP/2 optimizations.

This is the same patch-fast posture we walked through for the Cisco FMC RCE in CVE-2025-20265 and the Citrix NetScaler zero-day CVE-2025-6543. Internet-facing services with known flaws get probed within hours, not days.

---

Bottom line

MadeYouReset (CVE-2025-8671) is a new flavor of HTTP/2 protocol abuse, and it quietly defeats the mitigations everyone deployed after Rapid Reset.

If you run HTTP/2 anywhere it counts, you want to:

• Patch aggressively
• Apply the temporary mitigations where upgrades aren't ready
• Watch for protocol-level anomalies until you're fully remediated

Protocol logic gaps like this keep turning up because they're cheap to weaponize and hard to spot. Patching closes the door, but you also want to know the moment someone tries to walk through it. That's the gap deception fills. See how Mine2's deception platform turns attacker activity into early, high-confidence signal long before the CPU graph spikes.