'MadeYouReset' HTTP/2 flaw lets attackers DoS servers

Security researchers Gal Bar Nahum, Anat Bremler-Barr, and Yaniv Harel have published details of a "common design flaw" in implementations of the HyperText Transfer Protocol 2 (HTTP/2) allowing those with ill intent to create "massive Denial of Service attacks". And, being the underpinnings of the modern web, HTTP/2 is widely deployed enough to mean that they had to coordinate disclosure with more than a hundred affected vendors. "During recent research into HTTP/2, I found a DoS vulnerability I named MadeYouReset," Nahum explained in a blog post introducing the issue. "It lets an attacker create effectively unbounded concurrent work on servers while bypassing HTTP/2's built‑in concurrency limit. It builds on the flaw behind 2023's 'Rapid Reset,' with a neat twist that slips past the usual mitigation." First announced in 2012, HTTP/2 is still the most widely-used web protocol, despite public availability of its successor HTTP/3 which emerged in 2019. HTTP/2 brought a wealth of improvements over its first-generation predecessor, the brainchild of Sir Tim Berners-Lee at CERN. Sadly, it also brought with it no small number of bugs - including the one responsible for Nahum's vulnerability discovery. The flaw has been given the official identifier CVE-2025-8671 and, extends the earlier CVE-2023-44487 "Rapid Reset" vulnerability first disclosed in 2023 - which is, apparently, not yet fully fixed. Exploitation allows an attacker to bypass concurrency limits which would normally prev...