HTTP/2 MadeYouReset Vulnerability Enables Massive DDoS Attacks

Security researchers have disclosed a critical vulnerability in the HTTP/2 protocol that could enable massive distributed denial-of-service (DDoS) attacks, potentially affecting millions of web servers worldwide.

The flaw, dubbed “MadeYouReset” and assigned CVE-2025-8671, was publicly disclosed on August 13, 2025, by researchers who warn it could surpass the impact of the devastating “Rapid Reset” attacks from 2023.

Vulnerability Overview

The MadeYouReset vulnerability allows attackers to bypass HTTP/2’s built-in concurrency limits, enabling them to create unbounded concurrent work on target servers with minimal resources.

This represents a significant escalation from traditional DDoS methods, as attackers can overwhelm servers while using far less bandwidth and computational power than conventional attacks.

The research was conducted jointly by security expert Gal Bar-Nahum with Professor Anat Bremler-Barr and Yaniv Harel from Tel Aviv University ...