CVE-2025-5115 MadeYouReset HTTP/2 vulnerability

What is CVE-2025-5115?

CVE-2025-5115 is a high-severity denial of service vulnerability in Eclipse Jetty, published on 20 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In Eclipse Jetty, versions <=9.4.57, <=10.0.25, <=11.0.25, <=12.0.21, <=12.1.0.alpha2, an HTTP/2 client may trigger the server to send RST_STREAM frames, for example by sending frames that are malformed or that should not be sent in a particular stream state, therefore forcing the server to consume resources such as CPU and memory.

For example, a client can open a stream and then send WINDOW_UPDATE frames with window size increment of 0, which is illegal. Per specification https://www.rfc-editor.org/rfc/rfc9113.html#name-window_update , the server should send a RST_STREAM frame. The client can now open another stream and send another bad WINDOW_UPDATE, therefore causing the server to consume more resources than necessary, as this case does not exceed the max number of concurrent streams, yet the client is able to create an enormous amount of streams in a short period of time.

The attack can be performed with other conditions (for example, a DATA frame for a closed stream) that cause the server to send a RST_STREAM frame.

Links:

* https://github.com/jetty/jetty.project/security/advisories/GHSA-mmxm-8w33-wc4h

Weakness: CWE-400

Which versions are affected by CVE-2025-5115?

10 open source packages ship an affected version, including org.eclipse.jetty.http2:http2-common and org.eclipse.jetty.http2:jetty-http2-common. It affects 1 product.

Products include Eclipse Jetty.

How do I fix CVE-2025-5115?

Upgrade org.eclipse.jetty.http2:http2-common to a fixed version for your release line: 10.0.26, 11.0.26 or 9.4.58.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2025-5115 being exploited?

There is no known exploitation of CVE-2025-5115 in the wild and no public exploit code.

Other vulnerabilities in Eclipse Jetty

• CVE-2016-4800 Jetty contains an alias issue that could allow unauthenticated remote code execution due to specially crafted request Critical 9.8
• CVE-2019-17638 Operation on a Resource after Expiration or Release in Jetty Server Critical 9.4
• CVE-2018-12538 Access and integrity issue within Eclipse Jetty High 8.8
• CVE-2026-10050 Digest authentication lossy encoding High 8.7
• CVE-2024-7708 Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests High 7.5

All Eclipse Jetty vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLEANSTART-2026-DA06561, CLEANSTART-2026-QB24702, CLEANSTART-2026-TW91822, CLSA-2026-1786553094, DEBIAN-CVE-2025-5115, DLA-4299-1 and 25 more.