New “MadeYouReset” Flaws in HTTP/2 Allow Attackers to Launch DoS Attacks

A critical vulnerability affecting HTTP/2 implementations worldwide has emerged, allowing attackers to trigger devastating denial-of-service attacks by exploiting stream reset mechanisms.

Tracked as CVE-2025-8671 and colloquially known as “MadeYouReset,” this flaw creates a dangerous mismatch between HTTP/2 protocol specifications and how real-world web servers handle stream cancellation, opening the door for large-scale distributed denial-of-service operations.

Understanding the Technical Flaw

The vulnerability stems from a fundamental difference in how HTTP/2 implementations interpret stream resets.

When a client requests a stream reset through malformed frames or flow control errors, the HTTP/2 protocol considers the stream closed and removes it from the active stream counter.

However, backend servers continue processing the request and computing responses.

Attackers exploit this discrepancy by rapidly opening and resetting streams on a single connection, forcing servers to handle an unbounded number of concurrent HTTP requests while the protocol accounting system remains artificially low.

This attack vector differs from the infamous “Rapid Reset” vulnerability (CVE-2023-44487), which exploited client-sent stream resets.

MadeYouReset specifically targets server-sent stream resets, making it equally dangerous but requiring different exploitation techniques.

The vulnerability echoes the same fundamental problem: the protocol’s stream management doesn’t accurately reflect the actual workload servers must process.

The implications of MadeYouReset extend far beyond isolated servers. Threat actors can leverage this vulnerability to launch coordinated DDoS attacks that force targets completely offline or severely limit legitimate user connections.

Affected servers experience resource exhaustion through either excessive CPU consumption or memory depletion, depending on their HTTP/2 implementation.

Even the SETTINGS_MAX_CONCURRENT_STREAMS parameter, designed to prevent such abuse, proves ineffective because the protocol no longer counts reset streams in its active stream tally.

Major vendors, including Apache, Nginx, Tomcat, and OpenLiteSpeed, have released security patches addressing the vulnerability.

CERT/CC recommends that all organizations using HTTP/2 implementations implement rate limiting and RST_STREAM controls, effectively restricting both the number and frequency of stream resets per connection.

Organizations must prioritize immediate patching of affected systems.

The vulnerability poses an immediate threat to web infrastructure globally, and delaying mitigation leaves infrastructure vulnerable to coordinated attacks that could disrupt critical services.

Cyber Awareness Month Offer: Upskill With 100+ Premium Cybersecurity Courses From EHA's Diamond Membership: Join Today