CVE-2025-8671

Summary

A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.

Affected Software

VendorProductVersion RangeStatus
SUSE LinuxEnterprise Module for Development Tools15 SP2 < 15-SP5affected
SUSE LinuxEnterprise High Performance Computing (HPC)15 < 15 SP5affected
Varnish SoftwareVarnish Enterprise6.0.x <= 6.0.14r4affected
Varnish SoftwareVarnish Cache6.0LTS <= 6.014affected
Varnish SoftwareVarnish Cache5.x <= 7.71affected
FastlyH20579ecfaaffected
Wind RiverLinuxLTS22 <= TLS25affected
SUSE LinuxEnterprise Desktop15 SP6 < 15 SP7affected
SUSE LinuxEnterprise High Performance Computing15 SP3 < 15 SP7affected
SUSE LinuxEnterprise Module for Dev Tools15 SP3 < 15 SP7affected
SUSE LinuxEnterprise Module for Package Hub15 SP5 < 15 SP7affected
SUSE LinuxEnterprise Server12 SP5 < 15 SP7affected
SUSE LinuxEnterprise Server for SAP Applications15 SP6 < 15 SP7affected
SUSE LinuxSUSE Manager Server4.3affected
SUSE LinuxSUSE Manager Server LTS4.3affected
SUSE LinuxSUSE Manager Proxy4.3affected
SUSE LinuxSUSE Manager Retail Branch Server4.3affected
SUSE LinuxopenSUSE Leap15.6affected

Weaknesses

  • CWE-404 Improper Resource Shutdown or Release

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: yes
    • Technical Impact: partial

Additional References

CVE Program Container

Additional References

References