CVE-2025-8671 CVE-2025-8671
Attackers can cause denial of service by exploiting HTTP/2 stream reset mismatches to force excessive server resource consumption.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-8671?
CVE-2025-8671 is a high-severity denial of service vulnerability in Fastly Enterprise Desktop, published on 13 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.
Weakness: CWE-404
Which versions are affected by CVE-2025-8671?
1 open source package ship an affected version, including pingora-core.
| Package | Affected | Fixed in |
|---|---|---|
pingora-core crates.io | From 0.0.0-0 | 0.6.0 |
Linux distribution packages (2)
dnsdist openSUSE:Tumbleweed | All versions | 2.0.2-1.1 |
lighttpd openSUSE:Tumbleweed | All versions | 1.4.80-1.1 |
How do I fix CVE-2025-8671?
Upgrade pingora-core to 0.6.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-8671 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-8671 exists.
Public exploit code: 5 proofs of concept on GitHub.
Sources
Also known as ALPINE-CVE-2025-8671, CLEANSTART-2026-FY47942, CLEANSTART-2026-YS82863, DEBIAN-CVE-2025-8671, GHSA-mrjm-qq9m-9mjq, MGASA-2025-0239 and 15 more.