Skip to content
OpenAdvisories
High · 7.5 Public exploit CVE-2025-8671 EUVD-2025-24560GHSA-mrjm-qq9m-9mjqRUSTSEC-2025-0070

CVE-2025-8671

Published Aug 13, 2025 · Updated Nov 4, 2025 · Assigned by certcc

Vendor: Fastly Vendor: SUSE Linux Vendor: varnish-software Vendor: Wind River Systems Product: Enterprise Desktop Product: Enterprise High Performance Computing Product: Enterprise High Performance Computing (HPC) Product: Enterprise Module for Dev Tools Product: Enterprise Module for Development Tools Product: Enterprise Module for Package Hub Product: Enterprise Server Product: Enterprise Server for SAP Applications Product: H20 Product: Linux Product: openSUSE Leap Product: SUSE Manager Proxy Product: SUSE Manager Retail Branch Server Product: SUSE Manager Server Product: SUSE Manager Server LTS Product: Varnish Cache Product: Varnish Enterprise Package: dnsdist Package: dnsdist Package: h2o Package: h2o Package: lighttpd Package: lighttpd Package: pingora-core Package: varnish Package: varnish Package: varnish Platform: Linux Ecosystem: Alpine Ecosystem: crates.io Ecosystem: Debian Ecosystem: Ubuntu

Description

A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.

Affected products

VendorProductAffectedFixed
SUSE Linux Enterprise Module for Development Tools 15 SP2 – < 15-SP5 15-SP5
SUSE Linux Enterprise High Performance Computing (HPC) 15 – < 15 SP5 15 SP5
Varnish Software Varnish Enterprise 6.0.x – ≤ 6.0.14r4 —
Varnish Software Varnish Cache 6.0LTS – ≤ 6.014, 5.x – ≤ 7.71 —
Fastly H20 579ecfa —
Wind River Linux LTS22 – ≤ TLS25 —
SUSE Linux Enterprise Desktop 15 SP6 – < 15 SP7 15 SP7
SUSE Linux Enterprise High Performance Computing 15 SP3 – < 15 SP7 15 SP7
SUSE Linux Enterprise Module for Dev Tools 15 SP3 – < 15 SP7 15 SP7
SUSE Linux Enterprise Module for Package Hub 15 SP5 – < 15 SP7 15 SP7
SUSE Linux Enterprise Server 12 SP5 – < 15 SP7 15 SP7
SUSE Linux Enterprise Server for SAP Applications 15 SP6 – < 15 SP7 15 SP7
SUSE Linux SUSE Manager Server 4.3 —
SUSE Linux SUSE Manager Server LTS 4.3 —
SUSE Linux SUSE Manager Proxy 4.3 —
SUSE Linux SUSE Manager Retail Branch Server 4.3 —
SUSE Linux openSUSE Leap 15.6 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 13 varnish 7.7.0-3+deb13u1 —
Debian 12 h2o +1 No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 lighttpd No fix yet —
Ubuntu 26.04 LTS lighttpd No fix yet —
Ubuntu 25.10 dnsdist 1.9.10-1ubuntu0.1 USN-8037-1
Ubuntu 25.10 varnish +1 No fix yet —
Ubuntu 24.04 LTS h2o +2 No fix yet —
Ubuntu 22.04 LTS lighttpd No fix yet —
Show 8 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS lighttpd No fix yet —
Ubuntu 14.04 LTS varnish No fix yet —
Ubuntu Pro 24.04 LTS dnsdist 1.8.3-2ubuntu0.1~esm1 USN-8037-1
Ubuntu Pro 22.04 LTS dnsdist 1.6.1-1ubuntu0.1~esm2 USN-8037-1
Ubuntu Pro 22.04 LTS h2o +1 No fix yet —
Ubuntu Pro 20.04 LTS h2o +1 No fix yet —
Ubuntu Pro 18.04 LTS h2o +2 No fix yet —
Ubuntu Pro 16.04 LTS varnish +1 No fix yet —
Ubuntu Pro 14.04 LTS lighttpd No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 dnsdist 1.9.11-150700.3.6.1 SUSE-SU-2026:0888-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 dnsdist 1.9.11-160000.1.1 SUSE-SU-2026:20995-1
SLES 16.0 dnsdist 1.9.11-160000.1.1 SUSE-SU-2026:20995-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed bun 1.4.4-1.1 openSUSE-SU-2026:12316-1
openSUSE Tumbleweed dnsdist 2.0.2-1.1 openSUSE-SU-2026:10219-1
openSUSE Tumbleweed lighttpd 1.4.80-1.1 openSUSE-SU-2025:15448-1
openSUSE Leap 16.0 dnsdist 1.9.11-160000.1.1 openSUSE-SU-2026:20461-1
openSUSE Leap 16.0 varnish 7.7.3-bp160.1.1 openSUSE-SU-2026:22131-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 dnsdist 2.0.1-r0 —
Alpine v3.24 lighttpd 0-r0 —
Alpine v3.24 varnish 7.7.2-r0 —
Alpine v3.23 dnsdist 2.0.1-r0 —
Alpine v3.23 lighttpd 0-r0 —
Alpine v3.23 varnish 7.7.2-r0 —
Alpine v3.22 lighttpd 0-r0 —
Alpine v3.22 varnish 7.7.2-r0 —
Alpine v3.21 lighttpd 0-r0 —
Alpine v3.20 lighttpd 0-r0 —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 lighttpd 0-r0 —
Alpine v3.18 lighttpd 0-r0 —
Alpine v3.17 lighttpd 0-r0 —
Alpine v3.16 lighttpd 0-r0 —
Alpine v3.15 lighttpd 0-r0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 5 repositories

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io pingora-core >= 0.0.0-0, < 0.6.0 0.6.0 RUSTSEC-2025-0070

Advisories 10

References