GHSA-8grv-jq2g-cfhw
amphp/http-server affected by HTTP/2 DDoS vulnerability
Versions of amphp/http-server prior to 3.4.4 for the 3.x release branch and prior to 2.1.10 for the 2.x release branch are vulnerable to the HTTP/2 "MadeYouReset" DoS attack described by CVE-2025-8671 and https://kb.cert.org/vuls/id/767506.
In versions 3.4.4 and 2.1.10, stream reset protection has been refactored to account for the number of reset streams within a sliding time window.
Note that your application must expose HTTP/2 connections directly to be affected by this vulnerability. Servers behind a proxy using HTTP/1.x such as nginx are not affected.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
What each source reports
GitHub Advisories Score used
amphp/http-server affected by HTTP/2 DDoS vulnerability
Versions of amphp/http-server prior to 3.4.4 for the 3.x release branch and prior to 2.1.10 for the 2.x release branch are vulnerable to the HTTP/2 "MadeYouReset" DoS attack described by CVE-2025-8671 and https://kb.cert.org/vuls/id/767506.
In versions 3.4.4 and 2.1.10, stream reset protection has been refactored to account for the number of reset streams within a sliding time window.
Note that your application must expose HTTP/2 connections directly to be affected by this vulnerability. Servers behind a proxy using HTTP/1.x such as nginx are not affected.
- Record
GHSA-8grv-jq2g-cfhw- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
amphp/http-server affected by HTTP/2 DDoS vulnerability
Versions of amphp/http-server prior to 3.4.4 for the 3.x release branch and prior to 2.1.10 for the 2.x release branch are vulnerable to the HTTP/2 "MadeYouReset" DoS attack described by CVE-2025-8671 and https://kb.cert.org/vuls/id/767506.
In versions 3.4.4 and 2.1.10, stream reset protection has been refactored to account for the number of reset streams within a sliding time window.
Note that your application must expose HTTP/2 connections directly to be affected by this vulnerability. Servers behind a proxy using HTTP/1.x such as nginx are not affected.
- Record
GHSA-8grv-jq2g-cfhw- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-400
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
amphp/http-serverPackagist | 3.0.0-beta.1 up to 3.4.4 | 3.4.4 |
amphp/http-serverPackagist | 2.0.0-rc1 up to 2.1.10 | 2.1.10 |
amphp/http-serverPackagist | 3.0.0-beta.1 up to 3.4.4, plus listed versions v3.0.0v3.0.0-beta.1v3.0.0-beta.2v3.0.0-beta.3v3.0.0-beta.4 Show 12 moreShow lessv3.0.0-beta.5v3.0.0-beta.6v3.0.0-beta.7v3.0.0-beta.8v3.1.0v3.2.0v3.3.0v3.3.1v3.4.0v3.4.1v3.4.2v3.4.3 | 3.4.4 |
amphp/http-serverPackagist | 2.0.0-rc1 up to 2.1.10, plus listed versions v2.0.0v2.0.0-rc1v2.0.0-rc2v2.0.0-rc3v2.0.0-rc4 Show 11 moreShow lessv2.0.1v2.1.0v2.1.1v2.1.2v2.1.3v2.1.4v2.1.5v2.1.6v2.1.7v2.1.8v2.1.9 | 2.1.10 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-8grv-jq2g-cfhw is a medium vulnerability (CVSS 5.3) in amphp/http-server, published February 10, 2026. No source lists public exploit code. Fixed in amphp/http-server 3.4.4.