7.5
High
CVE-2025-8671 A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal…
Description
A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Enterprise Module for Development Tools 15 | earliest → < 15-SP5 | 15-SP5 |
| Enterprise High Performance Computing (HPC) 15 | 15 → latest | No fix stated |
| Varnish Enterprise 6.0 | 6.0.x → 6.0.14r4 | No fix stated |
| Varnish Cache 5 | 5.x → 7.71 | No fix stated |
| H20 | 579ecfa | No fix stated |
| Linux | Versions not published | |
| Enterprise Desktop | Versions not published | |
| Enterprise High Performance Computing | Versions not published | |
| Enterprise Module for Dev Tools | Versions not published |
Show the 8 other branches Hide the 8 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Enterprise Module for Package Hub | Versions not published | |
| Enterprise Server | Versions not published | |
| Enterprise Server for SAP Applications | Versions not published | |
| SUSE Manager Server | 4.3 | No fix stated |
| SUSE Manager Server LTS | 4.3 | No fix stated |
| SUSE Manager Proxy | 4.3 | No fix stated |
| SUSE Manager Retail Branch Server | 4.3 | No fix stated |
| openSUSE Leap | 15.6 | No fix stated |