{"id":"CVE-2025-8671","aliases":["ALPINE-CVE-2025-8671","DEBIAN-CVE-2025-8671","EUVD-2025-24560","GHSA-mrjm-qq9m-9mjq","MGASA-2025-0239","OESA-2025-2166","OESA-2025-2167","OESA-2025-2185","OESA-2025-2186","OESA-2025-2187","OESA-2025-2188","OESA-2025-2189","OESA-2025-2238","OESA-2025-2253","OESA-2025-2464","OESA-2026-1423","RUSTSEC-2025-0070","SUSE-SU-2026:0888-1","SUSE-SU-2026:20995-1","UBUNTU-CVE-2025-8671","USN-8037-1","openSUSE-SU-2025:15448-1","openSUSE-SU-2026:10219-1","openSUSE-SU-2026:12316-1","openSUSE-SU-2026:20461-1","openSUSE-SU-2026:22131-1"],"status":"published","title":"CVE-2025-8671","description":"A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS).  By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.03637,"percentile":0.89706,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-404"],"published":"2025-08-13T12:03:37Z","modified":"2026-11-03T06:33:01Z","exploits":[{"source":"pocgithub","id":"moften/CVE-2025-8671-MadeYouReset-HTTP-2-DDoS","title":"moften/CVE-2025-8671-MadeYouReset-HTTP-2-DDoS","date":"2025-08-18","url":"https://github.com/moften/CVE-2025-8671-MadeYouReset-HTTP-2-DDoS"},{"source":"pocgithub","id":"mateusm1403/PoC-CVE-2025-8671-MadeYouReset-HTTP-2","title":"mateusm1403/PoC-CVE-2025-8671-MadeYouReset-HTTP-2","date":"2025-08-21","url":"https://github.com/mateusm1403/PoC-CVE-2025-8671-MadeYouReset-HTTP-2"},{"source":"pocgithub","id":"abiyeenzo/CVE-2025-8671","title":"abiyeenzo/CVE-2025-8671","date":"2025-08-23","url":"https://github.com/abiyeenzo/CVE-2025-8671"},{"source":"pocgithub","id":"mysara2022/CVE-2025-8671-vulnerability-POC-","title":"mysara2022/CVE-2025-8671-vulnerability-POC-","date":"2026-02-09","url":"https://github.com/mysara2022/CVE-2025-8671-vulnerability-POC-"},{"source":"pocgithub","id":"ayushghatkar8080/MadeYouReset_Tester","title":"ayushghatkar8080/MadeYouReset_Tester","date":"2026-06-01","url":"https://github.com/ayushghatkar8080/MadeYouReset_Tester"}],"fixes":[{"ecosystem":"Alpine:v3.23","package":"dnsdist","fixed_in":["2.0.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"dnsdist","fixed_in":["2.0.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"lighttpd","fixed_in":["0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"lighttpd","fixed_in":["0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"lighttpd","fixed_in":["0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"lighttpd","fixed_in":["0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"lighttpd","fixed_in":["0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"lighttpd","fixed_in":["0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"lighttpd","fixed_in":["0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"lighttpd","fixed_in":["0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"lighttpd","fixed_in":["0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"lighttpd","fixed_in":["0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"varnish","fixed_in":["7.7.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"varnish","fixed_in":["7.7.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"varnish","fixed_in":["7.7.2-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"varnish","fixed_in":["7.7.0-3+deb13u1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"varnish","fixed_in":["7.7.3-1.mga9"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"lighttpd","fixed_in":["1.4.80-1.3.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"lighttpd","fixed_in":["1.4.72-2.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"lighttpd","fixed_in":["1.4.72-2.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"varnish","fixed_in":["7.4.3-4.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"varnish","fixed_in":["7.4.3-4.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"varnish","fixed_in":["7.4.3-4.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"varnish","fixed_in":["7.4.3-4.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"varnish","fixed_in":["7.4.3-4.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"lighttpd","fixed_in":["1.4.72-2.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"varnish","fixed_in":["7.4.3-4.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"lighttpd","fixed_in":["1.4.67-2.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"lighttpd","fixed_in":["1.4.67-2.oe2003sp4"],"sources":["osv"]},{"ecosystem":"crates.io","package":"pingora-core","fixed_in":["0.6.0"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"dnsdist","fixed_in":["1.8.3-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"dnsdist","fixed_in":["1.9.10-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"lighttpd","fixed_in":["1.4.80-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"dnsdist","fixed_in":["2.0.2-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.2-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"h2o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.5+dfsg2-10","2.2.5+dfsg2-11","2.2.5+dfsg2-7","2.2.5+dfsg2-8","2.2.5+dfsg2-8.1","2.2.5+dfsg2-8.1~exp1","2.2.5+dfsg2-9"]},{"source":"osv","ecosystem":"Debian:12","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.1.1-1.1","7.1.1-1.1+deb12u1","7.1.1-1.2","7.1.1-2+deb12u1","7.5.0-1","7.5.0-2","7.5.0-3","7.6.0-1","7.6.0-2","7.6.1-1","7.6.1-2","7.7.0-1","7.7.0-2","7.7.0-3","7.7.1-1","7.7.2-1","7.7.2-2","7.7.3-1","7.7.3-2","7.7.3-3"]},{"source":"osv","ecosystem":"Debian:13","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.0-3+deb13u1"}]}],"versions":["7.7.0-3"]},{"source":"osv","ecosystem":"Mageia:9","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.3-1.mga9"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.80-1.3.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.72-2.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.72-2.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.3-4.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.3-4.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.3-4.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.3-4.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.3-4.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.72-2.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.3-4.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.67-2.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.67-2.oe2003sp4"}]}]},{"source":"osv","ecosystem":"crates.io","package":"pingora-core","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.6.0"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.11-150700.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.11-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.11-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.31-3ubuntu3","1.4.33-1ubuntu1","1.4.33-1+nmu2ubuntu1","1.4.33-1+nmu2ubuntu2","1.4.33-1+nmu2ubuntu2.1","1.4.33-1+nmu2ubuntu2.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.4-1ubuntu1","3.0.4-1ubuntu2","3.0.5-1ubuntu2","3.0.5-2","3.0.5-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.35-4ubuntu1","1.4.35-4ubuntu2","1.4.35-4ubuntu2.1","1.4.35-4ubuntu2.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.3-1","4.1.0-1","4.1.0-2","4.1.1-1","4.1.1-1ubuntu0.2","4.1.1-1ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"h2o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.3+dfsg-2","2.2.4+dfsg-1","2.2.4+dfsg-1build1","2.2.4+dfsg-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.45-1ubuntu1","1.4.45-1ubuntu3","1.4.45-1ubuntu3+esm1","1.4.45-1ubuntu3.18.04","1.4.45-1ubuntu3.18.04+esm1","1.4.45-1ubuntu3.18.04.1","1.4.45-1ubuntu3.18.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-7.1","5.2.1-1","5.2.1-1ubuntu0.1","5.2.1-1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"h2o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.5+dfsg2-3","2.2.5+dfsg2-3build1","2.2.5+dfsg2-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.53-4ubuntu2","1.4.54-2ubuntu1","1.4.55-1ubuntu1","1.4.55-1ubuntu1.20.04.1","1.4.55-1ubuntu1.20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.1-1","6.2.1-2","6.2.1-2ubuntu0.1~esm1","6.2.1-2ubuntu0.1~esm2","6.2.1-2ubuntu0.1","6.2.1-2ubuntu0.2","6.2.1-2ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.59-1ubuntu2","1.4.59-1ubuntu3","1.4.63-1ubuntu1","1.4.63-1ubuntu2","1.4.63-1ubuntu3","1.4.63-1ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"h2o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.5+dfsg2-6","2.2.5+dfsg2-6.1","2.2.5+dfsg2-6.1ubuntu1","2.2.5+dfsg2-6.1ubuntu2","2.2.5+dfsg2-6.1ubuntu2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.2-1","6.6.1-1","6.6.1-1ubuntu0.2","6.6.1-1ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"h2o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.5+dfsg2-7","2.2.5+dfsg2-8","2.2.5+dfsg2-8.1ubuntu1","2.2.5+dfsg2-8.1ubuntu2","2.2.5+dfsg2-8.1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.69-1ubuntu1","1.4.69-1ubuntu2","1.4.73-1ubuntu1","1.4.73-1ubuntu2","1.4.74-1ubuntu2","1.4.74-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.1.1-1.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-2ubuntu0.1~esm1"}]}],"versions":["1.8.0-1","1.8.2-1","1.8.2-2","1.8.2-3","1.8.3-1","1.8.3-2","1.8.3-2build1","1.8.3-2build2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.10-1ubuntu0.1"}]}],"versions":["1.9.8-1","1.9.10-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.79-1ubuntu1","1.4.79-2ubuntu1","1.4.82-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.7.0-1","7.7.0-2","7.7.0-3","7.7.3-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.82-2ubuntu2","1.4.84-1ubuntu3","1.4.85-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.82-2ubuntu1","1.4.82-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-1ubuntu0.1~esm2"}]}],"versions":["1.5.1-3build2","1.6.1-1build1","1.6.1-1ubuntu0.1~esm1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-2ubuntu0.1~esm1"}]}],"versions":["1.8.0-1","1.8.2-1","1.8.2-2","1.8.2-3","1.8.3-1","1.8.3-2","1.8.3-2build1","1.8.3-2build2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.10-1ubuntu0.1"}]}],"versions":["1.9.8-1","1.9.10-1"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.80-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.2-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"bun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.11-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.3-bp160.1.1"}]}],"bundled":2}],"products":[{"vendor":"fastly","product":"h20"},{"vendor":"github","product":"enterprise server"},{"vendor":"linux","product":"linux"},{"vendor":"suse linux","product":"enterprise desktop"},{"vendor":"suse linux","product":"enterprise high performance computing"},{"vendor":"suse linux","product":"enterprise high performance computing (hpc)"},{"vendor":"suse linux","product":"enterprise module for dev tools"},{"vendor":"suse linux","product":"enterprise module for development tools"},{"vendor":"suse linux","product":"enterprise module for package hub"},{"vendor":"suse linux","product":"enterprise server"},{"vendor":"suse linux","product":"enterprise server for sap applications"},{"vendor":"suse linux","product":"opensuse leap"},{"vendor":"suse linux","product":"suse manager proxy"},{"vendor":"suse linux","product":"suse manager retail branch server"},{"vendor":"suse linux","product":"suse manager server"},{"vendor":"suse linux","product":"suse manager server lts"},{"vendor":"varnish software","product":"varnish cache"},{"vendor":"varnish software","product":"varnish enterprise"},{"vendor":"varnish-software","product":"varnish cache"},{"vendor":"varnish-software","product":"varnish enterprise"},{"vendor":"wind river","product":"linux"}],"references":[{"url":"https://galbarnahum.com/made-you-reset","tags":["web","report"]},{"url":"https://kb.cert.org/vuls/id/767506","tags":["web","report"]},{"url":"https://varnish-cache.org/security/VSV00017.html","tags":["web","report"]},{"url":"https://www.fastlystatus.com/incident/377810","tags":["web","report"]},{"url":"https://github.com/h2o/h2o/commit/4729b661e3c6654198d2cc62997e1af58bef4b80","tags":["fix","report"]},{"url":"https://support2.windriver.com/index.php?page=security-notices","tags":["web","report"]},{"url":"https://www.suse.com/support/kb/doc/?id=000021980","tags":["web","report"]},{"url":"https://gitlab.isc.org/isc-projects/bind9/-/issues/5325","tags":["exploit","report"]},{"url":"https://github.com/h2o/h2o/security/advisories/GHSA-mrjm-qq9m-9mjq","tags":["advisory","report"]},{"url":"https://github.com/envoyproxy/envoy/issues/40739","tags":["report"]},{"url":"https://github.com/varnish/hitch/issues/397","tags":["report"]},{"url":"https://github.com/Kong/kong/discussions/14731","tags":["web"]},{"url":"https://deepness-lab.org/publications/madeyoureset/","tags":["web"]},{"url":"https://www.imperva.com/blog/madeyoureset-turning-http-2-server-against-itself/","tags":["article"]},{"url":"https://www.kb.cert.org/vuls/id/767506","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/09/18/1","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/08/13/6","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-8671","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/8xxx/CVE-2025-8671.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-8671","tags":["advisory","web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-8671","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0239.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34587","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2025/08/13/6","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2025/08/16/1","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2166","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2167","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2185","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2186","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2187","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2188","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2189","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2238","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2253","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2464","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1423","tags":["advisory"]},{"url":"https://crates.io/crates/pingora-core","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2025-0070.html","tags":["advisory"]},{"url":"https://github.com/cloudflare/pingora/security/advisories/GHSA-393w-9x6h-8gc7","tags":["advisory"]},{"url":"https://blog.cloudflare.com/madeyoureset-an-http-2-vulnerability-thwarted-by-rapid-reset-mitigations/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260888-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1243566","tags":["report"]},{"url":"https://bugzilla.suse.com/1250054","tags":["report"]},{"url":"https://bugzilla.suse.com/1253852","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8671","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620995-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-8671","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-8671","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2025/09/18/1","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8037-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-30187","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-30193","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-44487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48618","tags":["web"]},{"url":"https://bugzilla.suse.com/1239892","tags":["report"]},{"url":"https://bugzilla.suse.com/1280114","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30346","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-8671","title":"CVE-2025-8671","description":"A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS).  By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.","status":"published","published":"2025-08-13T12:03:37.167Z","modified":"2025-11-04T21:15:08.215Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-404"],"updated_at":"2026-11-02T14:32:38.351095Z"}],"euvd":[{"id":"EUVD-2025-24560","description":"A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS).  By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.","status":"published","published":"2025-08-13T12:03:37Z","modified":"2025-11-04T21:15:08Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:20.707326Z"}],"nvd":[{"id":"CVE-2025-8671","description":"A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS).  By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.","status":"published","published":"2025-08-13T13:15:34.79Z","modified":"2026-06-17T10:07:24.987Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-404"],"updated_at":"2026-11-02T14:11:23.594522Z"}],"osv":[{"id":"ALPINE-CVE-2025-8671","description":"A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS).  By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.","status":"published","published":"2025-08-13T13:15:34.79Z","modified":"2026-11-03T06:33:01.226391987Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:15:53.944853Z"},{"id":"CVE-2025-8671","title":"CVE-2025-8671","description":"A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS).  By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.","status":"published","published":"2025-08-13T12:03:37.167Z","modified":"2026-10-29T12:27:01.447675324Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:53.185592Z"},{"id":"DEBIAN-CVE-2025-8671","description":"A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS).  By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.","status":"published","published":"2025-08-13T13:15:34.79Z","modified":"2026-09-01T20:05:58.985998987Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:48.440897Z"},{"id":"OESA-2025-2166","title":"lighttpd security update","description":"Secure, fast, compliant and very flexible web-server which has been optimized for high-performance environments. It has a very low memory footprint compared to other webservers and takes care of cpu-load. Its advanced feature-set (FastCGI, CGI, Auth, Output-Compression, URL-Rewriting and many more) make it the perfect webserver-software for every server that is suffering load problems.\r\n\r\nSecurity Fix(es):\n\nA mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.(CVE-2025-8671)","status":"published","published":"2025-09-05T11:09:15Z","modified":"2026-08-18T01:18:34.584002329Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2167","title":"lighttpd security update","description":"Secure, fast, compliant and very flexible web-server which has been optimized for high-performance environments. It has a very low memory footprint compared to other webservers and takes care of cpu-load. Its advanced feature-set (FastCGI, CGI, Auth, Output-Compression, URL-Rewriting and many more) make it the perfect webserver-software for every server that is suffering load problems.\r\n\r\nSecurity Fix(es):\n\nA mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.(CVE-2025-8671)","status":"published","published":"2025-09-05T11:09:15Z","modified":"2026-08-18T01:18:10.361474964Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2185","title":"varnish security update","description":"This is Varnish Cache, a web application accelerator also known as a caching HTTP reverse proxy. You install it in front of any server that speaks HTTP and configure it to cache the contents. Varnish Cache is really, really fast. It typically speeds up delivery with a factor of 300 - 1000x, depending on your architecture.\r\n\r\nSecurity Fix(es):\n\nA mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.(CVE-2025-8671)","status":"published","published":"2025-09-05T11:09:15Z","modified":"2026-08-18T01:18:23.319096707Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2186","title":"varnish security update","description":"This is Varnish Cache, a web application accelerator also known as a caching HTTP reverse proxy. You install it in front of any server that speaks HTTP and configure it to cache the contents. Varnish Cache is really, really fast. It typically speeds up delivery with a factor of 300 - 1000x, depending on your architecture.\r\n\r\nSecurity Fix(es):\n\nA mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.(CVE-2025-8671)","status":"published","published":"2025-09-05T11:09:16Z","modified":"2026-08-18T01:18:40.222641247Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2187","title":"varnish security update","description":"This is Varnish Cache, a web application accelerator also known as a caching HTTP reverse proxy. You install it in front of any server that speaks HTTP and configure it to cache the contents. Varnish Cache is really, really fast. It typically speeds up delivery with a factor of 300 - 1000x, depending on your architecture.\r\n\r\nSecurity Fix(es):\n\nA mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.(CVE-2025-8671)","status":"published","published":"2025-09-05T11:09:16Z","modified":"2026-08-18T01:18:40.173135405Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2188","title":"varnish security update","description":"This is Varnish Cache, a web application accelerator also known as a caching HTTP reverse proxy. You install it in front of any server that speaks HTTP and configure it to cache the contents. Varnish Cache is really, really fast. It typically speeds up delivery with a factor of 300 - 1000x, depending on your architecture.\r\n\r\nSecurity Fix(es):\n\nA mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.(CVE-2025-8671)","status":"published","published":"2025-09-05T11:09:16Z","modified":"2026-08-18T01:18:40.18828264Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2189","title":"varnish security update","description":"This is Varnish Cache, a web application accelerator also known as a caching HTTP reverse proxy. You install it in front of any server that speaks HTTP and configure it to cache the contents. Varnish Cache is really, really fast. It typically speeds up delivery with a factor of 300 - 1000x, depending on your architecture.\r\n\r\nSecurity Fix(es):\n\nA mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.(CVE-2025-8671)","status":"published","published":"2025-09-05T11:09:16Z","modified":"2026-08-18T01:18:40.234230508Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2238","title":"lighttpd security update","description":"Secure, fast, compliant and very flexible web-server which has been optimized for high-performance environments. It has a very low memory footprint compared to other webservers and takes care of cpu-load. Its advanced feature-set (FastCGI, CGI, Auth, Output-Compression, URL-Rewriting and many more) make it the perfect webserver-software for every server that is suffering load problems.\r\n\r\nSecurity Fix(es):\n\nA mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.(CVE-2025-8671)","status":"published","published":"2025-09-12T11:09:18Z","modified":"2026-08-18T01:18:11.32836834Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2253","title":"varnish security update","description":"This is Varnish Cache, a web application accelerator also known as a caching HTTP reverse proxy. You install it in front of any server that speaks HTTP and configure it to cache the contents. Varnish Cache is really, really fast. It typically speeds up delivery with a factor of 300 - 1000x, depending on your architecture.\r\n\r\nSecurity Fix(es):\n\nA mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.(CVE-2025-8671)","status":"published","published":"2025-09-12T11:09:19Z","modified":"2026-08-18T01:19:09.665332431Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2464","title":"lighttpd security update","description":"Secure, fast, compliant and very flexible web-server which has been optimized for high-performance environments. It has a very low memory footprint compared to other webservers and takes care of cpu-load. Its advanced feature-set (FastCGI, CGI, Auth, Output-Compression, URL-Rewriting and many more) make it the perfect webserver-software for every server that is suffering load problems.\r\n\r\nSecurity Fix(es):\n\nA mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.(CVE-2025-8671)","status":"published","published":"2025-10-17T11:09:33Z","modified":"2026-08-18T01:19:14.949116492Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2026-1423","title":"lighttpd security update","description":"Secure, fast, compliant and very flexible web-server which has been optimized for high-performance environments. It has a very low memory footprint compared to other webservers and takes care of cpu-load. Its advanced feature-set (FastCGI, CGI, Auth, Output-Compression, URL-Rewriting and many more) make it the perfect webserver-software for every server that is suffering load problems.\r\n\r\nSecurity Fix(es):\n\nA mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS).  By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.(CVE-2025-8671)","status":"published","published":"2026-02-13T11:10:26Z","modified":"2026-08-18T01:19:40.219506542Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"UBUNTU-CVE-2025-8671","description":"A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS).  By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.","status":"published","published":"2025-08-13T13:15:00Z","modified":"2026-10-17T12:57:46.218490745Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:55.926217Z"},{"id":"MGASA-2025-0239","title":"Updated varnish \u0026 lighttpd packages fix security vulnerability","description":"It was discovered that a denial of service attack can be performed on\ncache servers that have the HTTP/2 protocol turned on. An attacker can\ncreate a large number of streams and immediately reset them without ever\nreaching the maximum number of concurrent streams allowed for the\nsession, causing the server to consume unnecessary resources processing\nrequests for which the response will not be delivered (CVE-2025-8671).\n","status":"published","published":"2025-10-17T01:40:56Z","modified":"2026-04-16T04:41:33.899049373Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:15448-1","title":"lighttpd-1.4.80-1.1 on GA media","description":"These are all security issues fixed in the lighttpd-1.4.80-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-08-15T00:00:00Z","modified":"2026-03-23T04:53:47.689145Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2026:10219-1","title":"dnsdist-2.0.2-1.1 on GA media","description":"These are all security issues fixed in the dnsdist-2.0.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-18T00:00:00Z","modified":"2026-03-23T04:54:35.079752Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:12316-1","title":"bun-1.4.4-1.1 on GA media","description":"These are all security issues fixed in the bun-1.4.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-28T00:00:00Z","modified":"2026-10-29T12:15:07.048468223Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:20461-1","title":"Security update for dnsdist","description":"This update for dnsdist fixes the following issues:\n\nUpdate to dnsdist 1.9.11:\n\n- CVE-2025-8671: add mitigations for the HTTP/2 MadeYouReset attack (bsc#1253852).\n- CVE-2025-30187: denial of service via crafted DoH exchange (bsc#1250054).\n","status":"published","published":"2026-04-02T09:11:51Z","modified":"2026-04-09T18:24:46.296709Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:22131-1","title":"Security update for varnish","description":"This update for varnish fixes the following issues:\n\nChanges in varnish:\n\n- update to 7.7.3 (bsc#1280114, CVE-2025-8671):\n  * https://vinyl-cache.org/docs/7.7/whats-new/changes-7.7.html\n  * https://vinyl-cache.org/security/VSV00017.html#vsv00017\n\n- Update to release 7.7.1\n  * VSV-16: Resolve request smuggling attack\n\n- Update to release 7.7.0\n  * The `linux` jail gained control of transparent huge pages\n    settings.\n  * An issue has been fixed which could cause a crash when varnishd\n    receives an invalid Content-Range header from a backend.\n  * Timestamping for HTTP/2 requests (when idle period begins) has\n    been switched to be more in line with HTTP/1.\n  * VSV-15: The client connection is now always closed when a\n    malformed request is received. [CVE-2025-30346, boo#1239892]\n","status":"published","published":"2026-10-19T17:55:58Z","modified":"2026-10-20T19:15:03.943417663Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"RUSTSEC-2025-0070","title":"Pingora MadeYouReset HTTP/2 vulnerability","description":"Pingora deployments using versions prior to 0.6.0 that include HTTP/2 server support may be affected by the vulnerability described in CVE-2025-8671. Under certain conditions, Pingora applications may allocate buffers before the HTTP/2 reset and resulting stream cancellation is processed by the server. Repeated resets can force excessive memory consumption and lead to denial-of-service.\n\nOn affected versions, malicious clients could trigger unusually high memory consumption, which may result in service instability or process termination.\n\nThis issue is addressed by ensuring Pingora uses patched versions of HTTP/2 dependencies that include reset-handling safeguards to release connection resources before excessive memory buildup. Users are requested to upgrade to versions \u003e= 0.6.0, which incorporates the required fixes.","status":"published","published":"2025-09-17T12:00:00Z","modified":"2025-09-18T07:27:06.954909Z","updated_at":"2026-11-02T15:53:39.971022Z"},{"id":"SUSE-SU-2026:0888-1","title":"Security update for dnsdist","description":"This update for dnsdist fixes the following issues:\n\nUpdate to dnsdist 1.9.11:\n\n- CVE-2025-8671: Add mitigations for the HTTP/2 MadeYouReset attack (bsc#1253852).\n- CVE-2025-30187: denial of service via crafted DoH exchange (bsc#1250054).\n","status":"published","published":"2026-03-13T07:08:03Z","modified":"2026-03-14T08:16:00.15397Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:20995-1","title":"Security update for dnsdist","description":"This update for dnsdist fixes the following issues:\n\nUpdate to dnsdist 1.9.11:\n\n- CVE-2025-8671: add mitigations for the HTTP/2 MadeYouReset attack (bsc#1253852).\n- CVE-2025-30187: denial of service via crafted DoH exchange (bsc#1250054).\n","status":"published","published":"2026-04-02T09:16:22Z","modified":"2026-04-10T18:33:45.681171Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"USN-8037-1","title":"dnsdist vulnerabilities","description":"It was discovered that HTTP/2, which is used/vendored by DNSdist, did not\nproperly account for resources when handling client-triggered stream \nresets. An attacker could possibly use this issue to cause a \ndenial of service. (CVE-2025-8671)\n\nIt was discovered that DNSdist did not properly manage memory limits when\nhandling an unlimited number of queries on a single TCP connection. An \nattacker could possibly use this issue to cause a denial of service.\n(CVE-2025-30193)\n\nIt was discovered that DNSdist, when configured with the nghttp2 library,\ndid not correctly process certain DNS over HTTPS queries. An attacker\ncould possibly use this cause a denial of service. (CVE-2025-30187)","status":"published","published":"2026-02-12T15:41:01Z","modified":"2026-04-27T18:33:15.574144709Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}