CVE-2025-8671Disclosure

LOWCVSS 7.5 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Prioritize remediation for affected systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.

Back to dashboard

3.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-404

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

Public PoC and exploit tooling are both present
2 mentions across 2 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 1 signal
PoC mentioned or linked in 1 signal
Technical details provided in 2 signals
Disclosure: 1 classified signal
Peaked 1d ago at 1 mentions (2026-04-18); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification2 categories

Disclosure

150.0%

PoC

150.0%

Referenced assets1 URL

By indicator

https://github.com/ayushghatkar8080/MadeYouReset_Tester

Classification over time

Date	Total	Labels

2026-04-18	1	Disclosure1
2026-06-06	1	PoC1

Full discourse2 posts

Clandestine@akaclandestine125d
PoC
GitHub - ayushghatkar8080/MadeYouReset_Tester: A Python script that checks if a web server is vulnerable to MadeYouReset (CVE-2025-8671) — an HTTP/2 DoS attack that bypasses Rapid Reset mitigations by tricking the server into resetting its https://github.com/ayushghatkar8080/MadeYouReset_Tester
Post summary
A GitHub repository hosts a Python script that acts as a proof‑of‑concept for CVE‑2025‑8671, illustrating how a server can be forced into a reset to cause a DoS. The post provides technical details about the attack but does not mention active exploitation or a patch.
000431.1K
62.6K followersView on X
Idowu Oluwaseyi@idowuseyi22173d
Disclosure
MadeYouReset (CVE-2025-8671): A sophisticated DoS that tricks HTTP/2 servers into crashing themselves. It bypasses old "Rapid Reset" fixes. Check your API gateway logs for high memory spikes.
Post summary
The post reveals CVE-2025-8671 as a sophisticated DoS against HTTP/2 servers that bypasses prior reset mitigations, advising users to monitor API gateway logs for memory spikes.
10000413
26 followersView on X

Explore more

Back to dashboard