MadeYouReset: New HTTP/2 Flaw Could Unleash Massive DDoS Storms

Daily Security Review

Content provided by Daily Security Review. All podcast content including episodes, graphics, and podcast descriptions are uploaded and provided directly by Daily Security Review or their podcast platform partner. If you believe someone is using your copyrighted work without your permission, you can follow the process outlined here https://podcastplayer.com/legal.

8d ago 40:39

MP3•Episode home

A newly disclosed HTTP/2 vulnerability—dubbed MadeYouReset (CVE-2025-8671)—is making waves across the cybersecurity community for its potential to power devastating Denial-of-Service attacks. Building on the 2023 “Rapid Reset” flaw, this attack vector exploits a design oversight where servers keep processing backend requests even after a stream is canceled. By tricking the server into initiating its own stream resets—through malformed frames or flow control errors—attackers can bypass HTTP/2’s built-in concurrency limits and force servers to process an unbounded number of requests over a single connection.

The danger lies in the asymmetry: sending a request is cheap for the attacker, but processing it is resource-intensive for the server. This makes MadeYouReset capable of driving complete outages, causing out-of-memory crashes, and exhausting CPU resources. Researchers warn that its ability to blend seamlessly with normal traffic makes detection extremely challenging. While there are no confirmed cases of exploitation in the wild, similar to Rapid Reset, the widespread nature of the underlying flaw—inherent to most HTTP/2 implementations—means the risk is global and urgent.

Confirmed affected platforms include Apache Tomcat, H2O, Fastly, Mozilla, Netty, Varnish Software, F5 BIG-IP, gRPC, and many others. Major tech giants like Cisco, Google, IBM, and Microsoft are still assessing impact. Cloudflare’s existing mitigations from Rapid Reset appear to block this new attack vector, while other vendors are rushing patches to production. Security experts recommend immediate vendor advisory checks, patch application, stricter protocol validation, and connection-level rate limiting. In the absence of mitigations, temporarily disabling HTTP/2 may be necessary.

With the DDoS landscape already experiencing record-breaking attack volumes—peaks of 7.3 Tbps and billions of packets per second—MadeYouReset is a stark reminder that even well-formed traffic can be weaponized. The time to patch, monitor, and harden defenses is now—before this flaw shifts from theory to mass exploitation.

#MadeYouReset #CVE20258671 #HTTP2 #DDoS #RapidReset #ApacheTomcat #H2O #Varnish #Fastly #Netty #F5BIGIP #gRPC #Cloudflare #ZeroDay #cybersecurity #vulnerability #patchnow #DoS #networksecurity #websecurity

298 episodes

#Tech #News #Tech News #Daily Security Review