Description
A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
SUSE Linux Enterprise Module for Development Tools
15 SP2 to < 15-SP5affected
SUSE Linux Enterprise High Performance Computing (HPC)
15 to < 15 SP5affected
Varnish Software Varnish Enterprise
6.0.x to ≤ 6.0.14r4affected
Varnish Software Varnish Cache
6.0LTS to ≤ 6.014affected
Varnish Software Varnish Cache
5.x to ≤ 7.71affected
Fastly H20
579ecfaaffected
Wind River Linux
LTS22 to ≤ TLS25affected
SUSE Linux Enterprise Desktop
15 SP6 to < 15 SP7affected
SUSE Linux Enterprise High Performance Computing
15 SP3 to < 15 SP7affected
SUSE Linux Enterprise Module for Dev Tools
15 SP3 to < 15 SP7affected
SUSE Linux Enterprise Module for Package Hub
15 SP5 to < 15 SP7affected
SUSE Linux Enterprise Server
12 SP5 to < 15 SP7affected
SUSE Linux Enterprise Server for SAP Applications
15 SP6 to < 15 SP7affected
SUSE Linux SUSE Manager Server
4.3affected
SUSE Linux SUSE Manager Server LTS
4.3affected
SUSE Linux SUSE Manager Proxy
4.3affected
SUSE Linux SUSE Manager Retail Branch Server
4.3affected
SUSE Linux openSUSE Leap
15.6affected
References
- https://galbarnahum.com/made-you-reset ↗
- https://kb.cert.org/vuls/id/767506 ↗
- https://varnish-cache.org/security/VSV00017.html ↗
- https://www.fastlystatus.com/incident/377810 ↗
- https://github.com/h2o/h2o/commit/4729b661e3c6654198d2cc62997e1af58bef4b80 ↗
- https://support2.windriver.com/index.php?page=security-notices ↗
- https://www.suse.com/support/kb/doc/?id=000021980 ↗
- https://gitlab.isc.org/isc-projects/bind9/-/issues/5325 ↗
- https://github.com/h2o/h2o/security/advisories/GHSA-mrjm-qq9m-9mjq ↗
- https://github.com/envoyproxy/envoy/issues/40739 ↗
- https://github.com/varnish/hitch/issues/397 ↗
- https://github.com/Kong/kong/discussions/14731 ↗
- https://deepness-lab.org/publications/madeyoureset/ ↗
- https://www.imperva.com/blog/madeyoureset-turning-http-2-server-against-itself/ ↗
- https://www.kb.cert.org/vuls/id/767506 ↗
- http://www.openwall.com/lists/oss-security/2025/09/18/1 ↗
- http://www.openwall.com/lists/oss-security/2025/08/13/6 ↗