http/2 Implementierungen: Schwachstelle ermöglicht Denial of Service

Summary

Product

Vulnerabilities 4

• High 8.2
  CVE-2025-55163 Public exploit

  Netty MadeYouReset HTTP/2 DDoS Vulnerability

  Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames …

  netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  Aug 13, 2025
• High 7.7
  CVE-2025-5115

  MadeYouReset HTTP/2 vulnerability

  In Eclipse Jetty, versions <=9.4.57, <=10.0.25, <=11.0.25, <=12.0.21, <=12.1.0.alpha2, an HTTP/2 client may trigger the server to send RST_STREAM frames, for example by sending frames that are malformed or that should not be sent in a particular stream state,…

  Eclipse Jetty Eclipse Jetty trino trino-plugin-opensearch Debian Ubuntu Wolfi Maven
  Aug 20, 2025
• High 7.5
  CVE-2025-48989

  Apache Tomcat: h2 DoS - Made You Reset

  Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older,…

  Apache Software Foundation Apache Tomcat tomcat9 tomcat8 Debian Ubuntu Maven
  Aug 13, 2025
• High 7.5
  CVE-2025-8671 Public exploit

  CVE-2025-8671

  A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening stre…

  varnish-software Wind River Systems Fastly SUSE Linux Linux Debian Ubuntu Alpine crates.io
  Aug 13, 2025

Revision history

1. 2026-11-03 #55

   Neue Updates von IBM aufgenommen

2. 2026-10-20 #54

   Neue Updates von openSUSE aufgenommen

3. 2026-09-01 #53

   Neue Updates von Red Hat aufgenommen

4. 2026-04-27 #52

   Neue Updates von IBM aufgenommen

5. 2026-03-31 #51

   Neue Updates von Debian aufgenommen

6. 2026-03-26 #50

   Neue Updates von SUSE aufgenommen

7. 2026-03-23 #49

   Neue Updates von Dell aufgenommen

8. 2026-03-18 #48

   Neue Updates von Red Hat aufgenommen

9. 2026-03-11 #47

   Neue Updates von Debian aufgenommen

10. 2026-02-19 #46

    Neue Updates von openSUSE aufgenommen

11. 2026-02-05 #45

    Neue Updates von Debian aufgenommen

12. 2026-01-29 #44

    Neue Updates von IBM aufgenommen

13. 2026-01-20 #43

    Neue Updates von IBM aufgenommen

14. 2026-01-18 #42

    Neue Updates von Red Hat aufgenommen

15. 2025-12-16 #41

    Neue Updates von Red Hat aufgenommen

16. 2025-12-09 #40

    Neue Updates von Red Hat aufgenommen

17. 2025-12-03 #39

    Neue Updates aufgenommen

18. 2025-12-01 #38

    Neue Updates aufgenommen

19. 2025-11-30 #37

    Neue Updates von Dell aufgenommen

20. 2025-11-25 #36

    Neue Updates von IBM aufgenommen

21. 2025-11-19 #35

    Neue Updates von IBM aufgenommen

22. 2025-11-18 #34

    Neue Updates aufgenommen

23. 2025-11-17 #33

    Neue Updates von XEROX aufgenommen

24. 2025-11-04 #32

    Neue Updates von Dell aufgenommen

25. 2025-10-29 #31

    Neue Updates von Fedora aufgenommen

References

• Gal Bar Nahum's Blog - MadeYouReset Series vom 2025-08-13
  https://galbarnahum.com/made-you-reset
• CERT/CC VU#767506 vom 2025-08-13
  https://kb.cert.org/vuls/id/767506
• Varnish Security Advisory VSV00017 vom 2025-08-13
  https://varnish-cache.org/security/VSV00017.html
• Mailing List OSS Security vom 2025-08-13
  https://seclists.org/oss-sec/2025/q3/95
• Tomcat 9 Security vom 2025-08-13
  https://tomcat.apache.org/security-9.html
• Tomcat 10 Security vom 2025-08-13
  https://tomcat.apache.org/security-10.html
• Tomcat 11 Security vom 2025-08-13
  https://tomcat.apache.org/security-11.html
• Red Hat Security Advisory RHSA-2025:13686 vom 2025-08-13
  https://access.redhat.com/errata/RHSA-2025:13686
• Red Hat Security Advisory RHSA-2025:13685 vom 2025-08-14
  https://access.redhat.com/errata/RHSA-2025:13685
• openSUSE Security Update OPENSUSE-SU-2025:15449-1 vom 2025-08-16
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LD37QPQBLKIFMKWJXACHGPA7WALFCOM7/
• Red Hat Security Advisory RHSA-2025:14004 vom 2025-08-19
  https://access.redhat.com/errata/RHSA-2025:14004
• Red Hat Security Advisory RHSA-2025:14008 vom 2025-08-19
  https://access.redhat.com/errata/RHSA-2025:14008
• Red Hat Security Advisory RHSA-2025:14182 vom 2025-08-20
  https://access.redhat.com/errata/RHSA-2025:14182
• Red Hat Security Advisory RHSA-2025:14177 vom 2025-08-20
  https://access.redhat.com/errata/RHSA-2025:14177
• Red Hat Security Advisory RHSA-2025:14180 vom 2025-08-21
  https://access.redhat.com/errata/RHSA-2025:14180
• GitHub Security Advisory GHSA-MMXM-8W33-WC4H vom 2025-08-20
  https://github.com/jetty/jetty.project/security/advisories/GHSA-mmxm-8w33-wc4h
• Red Hat Security Advisory RHSA-2025:14179 vom 2025-08-20
  https://access.redhat.com/errata/RHSA-2025:14179
• Red Hat Security Advisory RHSA-2025:14178 vom 2025-08-20
  https://access.redhat.com/errata/RHSA-2025:14178
• Red Hat Security Advisory RHSA-2025:14183 vom 2025-08-20
  https://access.redhat.com/errata/RHSA-2025:14183
• Oracle Linux Security Advisory ELSA-2025-14177 vom 2025-08-21
  https://linux.oracle.com/errata/ELSA-2025-14177.html
• Red Hat Security Advisory RHSA-2025:14197 vom 2025-08-20
  https://access.redhat.com/errata/RHSA-2025:14197
• Red Hat Security Advisory RHSA-2025:14181 vom 2025-08-20
  https://access.redhat.com/errata/RHSA-2025:14181
• Oracle Linux Security Advisory ELSA-2025-14181 vom 2025-08-21
  https://linux.oracle.com/errata/ELSA-2025-14181.html
• New Varnish Cache releases (7.7.3, 7.6.5 and 6.0.16) vom 2025-08-20
  https://varnish-cache.org/lists/pipermail/varnish-announce/2025-August/000771.html
• Oracle Linux Security Advisory ELSA-2025-14178 vom 2025-08-21
  https://linux.oracle.com/errata/ELSA-2025-14178.html
• PoC CVE-2025-8671 vom 2025-08-24
  https://github.com/abiyeenzo/CVE-2025-8671
• openSUSE Security Update OPENSUSE-SU-2025:15483-1 vom 2025-08-23
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EXDF5TMMN4LHEDWLII7MMDPWQR5D6UWU/
• Oracle Linux Security Advisory ELSA-2025-14179 vom 2025-08-22
  https://linux.oracle.com/errata/ELSA-2025-14179.html
• openSUSE Security Update OPENSUSE-SU-2025:15490-1 vom 2025-08-26
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HVS2SK75HFDIVZCEQSOAOL6TTJCJFJZK/
• openSUSE Security Update OPENSUSE-SU-2025:15491-1 vom 2025-08-26
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/PFPY4ZCVL2NZMRDOWWAY4ZBXIIA663BF/
• openSUSE Security Update OPENSUSE-SU-2025:15489-1 vom 2025-08-26
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/UBHMT4B4D7HRMDPQJYDEV5UUSG7LVAHI/
• SUSE Security Update SUSE-SU-2025:02992-1 vom 2025-08-27
  https://lists.suse.com/pipermail/sle-security-updates/2025-August/022280.html
• SUSE Security Update SUSE-SU-2025:02993-1 vom 2025-08-27
  https://lists.suse.com/pipermail/sle-security-updates/2025-August/022294.html
• Camunda Security Notice 144 vom 2025-08-28
  https://docs.camunda.org/security/notices/
• SUSE Security Update SUSE-SU-2025:03006-1 vom 2025-08-28
  https://lists.suse.com/pipermail/sle-security-updates/2025-August/022326.html
• ATOSS Sicherheitsmitteilung: Apache Tomcat-Sicherheitslücken vom 2025-08-28
  https://www.atoss.ch/de-ch/sicherheit/security-news
• Red Hat Security Advisory RHSA-2025:14911 vom 2025-08-28
  https://access.redhat.com/errata/RHSA-2025:14911
• SUSE Security Update SUSE-SU-2025:03024-1 vom 2025-08-29
  https://lists.suse.com/pipermail/sle-security-updates/2025-August/022345.html
• SUSE Security Update SUSE-SU-2025:03021-1 vom 2025-08-29
  https://lists.suse.com/pipermail/sle-security-updates/2025-August/022331.html
• SUSE Security Update SUSE-SU-2025:02993-2 vom 2025-09-01
  https://lists.suse.com/pipermail/sle-security-updates/2025-September/022373.html
• SUSE Security Update SUSE-SU-2025:02993-2 vom 2025-09-01
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WDVRXONEUUASOWSNXL4RQLFHU45FFDH6/
• Red Hat Security Advisory RHSA-2025:14919 vom 2025-09-03
  https://access.redhat.com/errata/RHSA-2025:14919
• Amazon Linux Security Advisory ALAS2TOMCAT9-2025-022 vom 2025-09-04
  https://alas.aws.amazon.com/AL2/ALAS2TOMCAT9-2025-022.html
• PDFreactor Release Notes vom 2025-09-05
  https://www.pdfreactor.com/pdfreactor-12-3-now-available/
• Rocky Linux Security Advisory RLSA-2025:14177 vom 2025-09-08
  https://errata.build.resf.org/RLSA-2025:14177
• SUSE Security Update SUSE-SU-2025:03114-1 vom 2025-09-09
  https://lists.suse.com/pipermail/sle-security-updates/2025-September/022412.html
• Red Hat Security Advisory RHSA-2025:15612 vom 2025-09-10
  https://access.redhat.com/errata/RHSA-2025:15612
• Red Hat Security Advisory RHSA-2025:15697 vom 2025-09-11
  https://access.redhat.com/errata/RHSA-2025:15697
• Debian Security Advisory DLA-4299 vom 2025-09-14
  https://lists.debian.org/debian-lts-announce/2025/09/msg00014.html
• Debian Security Advisory DSA-6005 vom 2025-09-19
  https://lists.debian.org/debian-security-announce/2025/msg00169.html
• Debian Security Advisory DSA-6006 vom 2025-09-19
  https://lists.debian.org/debian-security-announce/2025/msg00170.html
• Red Hat Security Advisory RHSA-2025:16407 vom 2025-09-23
  https://access.redhat.com/errata/RHSA-2025:16407
• Red Hat Security Advisory RHSA-2025:16457 vom 2025-09-23
  https://access.redhat.com/errata/RHSA-2025:16457
• Red Hat Security Advisory RHSA-2025:16459 vom 2025-09-23
  https://access.redhat.com/errata/RHSA-2025:16459
• Red Hat Security Advisory RHSA-2025:16460 vom 2025-09-23
  https://access.redhat.com/errata/RHSA-2025:16460
• Red Hat Security Advisory RHSA-2025:16462 vom 2025-09-23
  https://access.redhat.com/errata/RHSA-2025:16462
• Red Hat Security Advisory RHSA-2025:16454 vom 2025-09-23
  https://access.redhat.com/errata/RHSA-2025:16454
• Red Hat Security Advisory RHSA-2025:16456 vom 2025-09-23
  https://access.redhat.com/errata/RHSA-2025:16456
• Red Hat Security Advisory RHSA-2025:16455 vom 2025-09-23
  https://access.redhat.com/errata/RHSA-2025:16455
• IBM Security Bulletin 7246095 vom 2025-09-29
  https://www.ibm.com/support/pages/node/7246095
• Red Hat Security Advisory RHSA-2025:16989 vom 2025-09-29
  https://access.redhat.com/errata/RHSA-2025:16989
• Red Hat Security Advisory RHSA-2025:17317 vom 2025-10-02
  https://access.redhat.com/errata/RHSA-2025:17317
• Red Hat Security Advisory RHSA-2025:17318 vom 2025-10-02
  https://access.redhat.com/errata/RHSA-2025:17318
• NetApp Security Advisory NTAP-20251003-0005 vom 2025-10-03
  https://security.netapp.com/advisory/NTAP-20251003-0005
• Red Hat Security Advisory RHSA-2025:17299 vom 2025-10-02
  https://access.redhat.com/errata/RHSA-2025:17299
• Red Hat Security Advisory RHSA-2025:17298 vom 2025-10-02
  https://access.redhat.com/errata/RHSA-2025:17298
• Red Hat Security Advisory RHSA-2025:17567 vom 2025-10-08
  https://access.redhat.com/errata/RHSA-2025:17567
• IBM Security Bulletin 7247555 vom 2025-10-09
  https://www.ibm.com/support/pages/node/7247555
• HCL Security Bulletin vom 2025-10-15
  https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124532
• Atlassian Security Bulletin
  https://jira.atlassian.com/browse/BAM-26217
• Atlassian Security Bulletin
  https://confluence.atlassian.com/security/security-bulletin-october-21-2025-1652920034.html
• Red Hat Security Advisory RHSA-2025:18989 vom 2025-10-22
  https://access.redhat.com/errata/RHSA-2025:18989
• IBM Security Bulletin 7248973 vom 2025-10-23
  https://www.ibm.com/support/pages/node/7248973
• Red Hat Security Advisory RHSA-2025:19094 vom 2025-10-24
  https://access.redhat.com/errata/RHSA-2025:19094
• IBM Security Bulletin 7249276 vom 2025-10-27
  https://www.ibm.com/support/pages/node/7249276
• Fedora Security Advisory FEDORA-2025-2FF6E32273 vom 2025-10-30
  https://bodhi.fedoraproject.org/updates/FEDORA-2025-2ff6e32273
• Dell Security Advisory DSA-2025-390 vom 2025-11-05
  https://www.dell.com/support/kbdoc/000385230
• XEROX Security Advisory XRX25-018 vom 2025-11-18
  https://security.business.xerox.com/wp-content/uploads/2025/11/Xerox-Security-Bulletin-XRX25-018-Xerox-FreeFlow-Print-Server-v7.pdf
• Atlassian Security Bulletin - November 18 2025
  https://confluence.atlassian.com/security/security-bulletin-november-18-2025-1671463469.html
• IBM Security Bulletin 7252039 vom 2025-11-20
  https://www.ibm.com/support/pages/node/7252039