MadeYouReset: An HTTP/2 vulnerability thwarted by Rapid Reset mitigations
Aug 15, 2025Alex Forster, Noah Maxwell Kennedy, Lucas Pardue, Evan Rittenhouse
Summary
This post details the MadeYouReset (CVE-2025-8671) HTTP/2 vulnerability, which exploits server-sent stream resets. It explains how Cloudflare's existing mitigations for Rapid Reset and general HTTP/2 RFC 9113 compliance provide protection against this new vulnerability. It also notes that the Rust-language h2 library used by Cloudflare's Pingora framework was potentially susceptible in versions prior to 0.4.11, and advises users to update.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack