GHSA-8grv-jq2g-cfhw amphp/http-server affected by HTTP/2 DDoS vulnerability
Attackers can cause denial of service in amphp/http-server via HTTP/2 MadeYouReset attacks if HTTP/2 is directly exposed.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-8grv-jq2g-cfhw?
GHSA-8grv-jq2g-cfhw is a denial of service vulnerability in amphp/http-server, published on 10 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of amphp/http-server prior to 3.4.4 for the 3.x release branch and prior to 2.1.10 for the 2.x release branch are vulnerable to the HTTP/2 "MadeYouReset" DoS attack described by CVE-2025-8671 and https://kb.cert.org/vuls/id/767506.
In versions 3.4.4 and 2.1.10, stream reset protection has been refactored to account for the number of reset streams within a sliding time window.
Note that your application must expose HTTP/2 connections directly to be affected by this vulnerability. Servers behind a proxy using HTTP/1.x such as nginx are not affected.
Which versions are affected by GHSA-8grv-jq2g-cfhw?
4 open source packages ship an affected version, including amphp/http-server.
| Package | Affected | Fixed in |
|---|---|---|
amphp/http-server Packagist | From 2.0.0-rc1 | 2.1.10 |
amphp/http-server Packagist | From 2.0.0-rc1 | 2.1.10 |
amphp/http-server Packagist | From 3.0.0-beta.1 | 3.4.4 |
amphp/http-server Packagist | From 3.0.0-beta.1 | 3.4.4 |
How do I fix GHSA-8grv-jq2g-cfhw?
Upgrade amphp/http-server to a fixed version for your release line: 2.1.10 or 3.4.4.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-8grv-jq2g-cfhw being exploited?
There is no known exploitation of GHSA-8grv-jq2g-cfhw in the wild and no public exploit code.