MadeYouReset: An HTTP/2 vulnerability thwarted by Rapid Reset mitigations

HTTP/2 “MadeYouReset” Flaw Exploits Server-Sent Stream Resets

On August 13, researchers at Tel Aviv University publicly disclosed a new HTTP/2 denial-of-service vulnerability, tracked as CVE-2025-8671 and dubbed “MadeYouReset.” The flaw affects a limited set of unpatched HTTP/2 server implementations that fail to track server-sent stream resets accurately, potentially leading to resource exhaustion.

The issue bears conceptual similarity to the Rapid Reset vulnerability (CVE-2023-44487) disclosed in 2023. Both attacks abuse a core mechanism defined in RFC 9113, the HTTP/2 specification: the RST_STREAM frame. In HTTP/2, a client opens a bidirectional stream to exchange requests and responses via HEADERS and DATA frames. The RST_STREAM frame allows either endpoint to terminate a stream prematurely, signalling that no further data will be processed. The protocol also mandates sending RST_STREAM in response to certain protocol errors—for example, section 6.1 of RFC 9113 requires a stream error of type STREAM_CLOSED when a DATA frame arrives under invalid circumstances.

Attackers can weaponize this reset mechanism. By repeatedly forcing streams to be created and then immediately cancelled, they force the server to spend CPU cycles initiating and discarding operations. That churn can deplete resources and impair availability for legitimate users. The distinction between the two vulnerabilities lies in direction: Rapid Reset exploits client-initiated resets, while MadeYouReset tricks a server into issuing resets of its own. An attacker induces protocol violations by sending intentionally malformed frames, which trigger stream errors and compel the server to generate RST_STREAM responses.

Protocol Hardening Pays Off

RFC 9113’s denial-of-service guidance acknowledges that many legitimate HTTP/2 features can be abused. The specification warns that “an endpoint that doesn't monitor use of these features exposes itself to a risk of denial of service” and recommends that implementations track usage and enforce limits.

Most major HTTP/2 stacks in widespread use have already adopted these mitigations during the Rapid Reset wave of 2023. Those proactive defences have proven largely effective against MadeYouReset, limiting the flaw’s real-world impact and preventing another disruption on the scale of Rapid Reset.

Cloudflare, which participated in the coordinated disclosure process after being informed in May, confirmed its own systems were not susceptible. The company states that it anticipated this attack class while addressing the “Netflix vulnerabilities” in 2019 and strengthened its defences further after Rapid Reset. Consequently, HTTP DDoS mitigation customers are already protected. Notably, Cloudflare’s open-source Pingora framework relies on the Rust-language h2 library for HTTP/2 support; versions before 0.4.11 were potentially vulnerable. Pingora users can patch by updating the h2 crate via cargo update. Pingora does not terminate inbound HTTP connections on Cloudflare’s network, so the flaw could not be exploited against Cloudflare infrastructure.

The research team—Gal Bar Nahum, Anat Bremler-Barr, and Yaniv Harel of Tel Aviv University—disclosed the vulnerability through a coordinated process. Cloudflare encourages researchers to report similar findings through its HackerOne Bug Bounty program.