NRDAX-T0111 - HTTP/2 Rapid Reset Memory Exhaustion

mechanism

CVE-2025-8671 "MadeYouReset" (CVE-2025-55163 / GHSA-prj3-ccx8-p6x4 / VU#767506): an unauthenticated attacker opens an HTTP/2 stream (HEADERS, END_STREAM - a complete request) and then sends a protocol-valid-but-misused control frame - this driver uses WINDOW_UPDATE with a flow-control increment of 0 (a stream error PROTOCOL_ERROR per RFC 9113 §6.9.1) - which forces the SERVER to emit RST_STREAM. Because a reset stream is immediately no longer counted as active, the server's MAX_CONCURRENT_STREAMS ceiling (typ. 100) is never reached, yet the backend has already been handed the request and keeps processing it. Repeating the HEADERS+WINDOW_UPDATE(0) cycle floods the server with unbounded concurrent backend work -> memory/CPU exhaustion -> OOM / CPU-pin -> DoS (Tomcat manifests as OutOfMemoryError). This is DISTINCT from CVE-2023-44487 HTTP/2 Rapid Reset: there the CLIENT sends RST_STREAM, so the reset frames are inbound and rate-limitable; here the RST_STREAM is SERVER-emitted (outbound), so the post-CVE-2023-44487 client-side rapid-reset mitigations do not apply. Faithful known-class replication of the MadeYouReset wire signature (HEADERS+END_STREAM, then WINDOW_UPDATE with a zero increment, then a server-emitted RST_STREAM); the OOM/CPU impact is the CVE's, not reproduced against a live server. source_class=public-cve-replication. Distinct wire signature from the sibling rapid-reset drivers (walrus_http2_rapid_reset / substrate_h2_rapid_reset), which are CLIENT-emitted RST.

instances (1)

references

cite

https://nrdax.com/techniques/NRDAX-T0111

@misc{nrdax_NRDAX_T0111,
  title = {HTTP/2 Rapid Reset Memory Exhaustion (NRDAX-T0111)},
  howpublished = {NRDAX Registry},
  url = {https://nrdax.com/techniques/NRDAX-T0111},
}

{
  "id": "nrdax-NRDAX-T0111",
  "type": "dataset",
  "title": "HTTP/2 Rapid Reset Memory Exhaustion (NRDAX-T0111)",
  "URL": "https://nrdax.com/techniques/NRDAX-T0111",
  "publisher": "NRDAX Registry"
}

[![NRDAX-T0111 in the NRDAX registry](https://nrdax.com/badge/NRDAX-T0111.svg)](https://nrdax.com/techniques/NRDAX-T0111-http-2-rapid-reset-memory-exhaustion)