Vulnerabilitycritical
New HTTP/2 'MadeYouReset' Vulnerability Enables Large
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-44487 | Rapid Reset Denial-of-Service in HTTP/2 (CWE-400 Resource Exhaustion) | 7.5 | 100% | KEV | KEV |
| CVE-2025-32094 | Akamai Ghost: Under certain circumstances, a client making an HTTP/1.x OPTIONS request with an "Expect: 100-continue" header, and using… | 4.0 | <1% | ||
| CVE-2025-4366 | A request smuggling vulnerability identified within Pingora’s proxying framework, pingora-proxy, allows malicious HTTP requests to be injected via manipulated… | 7.4 | <1% | ||
| CVE-2025-48989 | Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack | 7.5 | 4% | ||
| CVE-2025-54500 | An HTTP/2 implementation flaw allows a denial-of-service (DoS) that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit… | 6.9 | <1% | ||
| CVE-2025-55163 | Netty: Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2… | 8.2 | 1% | PoC | |
| CVE-2025-8671 | A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may… | 7.5 | 4% |
From the original article
3 min read at thehackernews.com
Ravie Lakshmanan Aug 14, 2025 Server Security / Vulnerability Multiple HTTP/2 implementations have been found susceptible to a new attack technique called MadeYouReset that could be explored to conduct powerful denial-of-service (DoS) attacks. "MadeYouReset bypasses the typical server-imposed limit of 100 concurrent HTTP/2 requests per TCP connection from a client.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.