Bug 1243888 (CVE-2025-8671) - VUL-0: CVE-2025-8671: TRACKERBUG: HTTP/2 protocol (including DNS over HTTPS) is vulnerable to "MadeYouReset" DoS attack
Summary: VUL-0: CVE-2025-8671: TRACKERBUG: HTTP/2 protocol (including DNS over HTTPS) ...
Status: NEW
Alias: CVE-2025-8671
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P2 - High : Normal
Target Milestone: ---
Deadline: 2025-06-18
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/457492/
Whiteboard: CVSSv3.1:SUSE:CVE-2025-48989:7.5:(AV:...
Keywords:
Depends on: CVE-2025-48989 CVE-2025-5115 CVE-2025-55163 CVE-2025-54500 1253852
Blocks:
  Show dependency tree / graph
 
Reported: 2025-05-31 16:47 UTC by Marcus Meissner
Modified: 2026-02-17 18:25 UTC (History)
5 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Comment 2 Camila Camargo de Matos 2025-08-13 12:27:23 UTC 
A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.

References:
https://www.cve.org/CVERecord?id=CVE-2025-8671
https://github.com/galbarnahum/MadeYouReset
https://kb.cert.org/vuls/id/767506
Comment 4 OBSbugzilla Bot 2026-02-17 18:25:01 UTC 
This is an autogenerated message for OBS integration:
This bug (1243888) was mentioned in
https://build.opensuse.org/request/show/1333620 Factory / dnsdist