ayushghatkar8080/madeyoureset_tester
A Python script that checks if a web server is vulnerable to MadeYouReset (CVE-2025-8671) — an HTTP/2 DoS attack that bypasses Rapid Reset mitigations by tricking the server into resetting its own streams. It probes the target by sending a malformed WINDOW_UPDATE frame and inspects whether the server responds.
A lightweight Python script to detect whether a web server is potentially vulnerable to the MadeYouReset HTTP/2 denial-of-service vulnerability — tracked as CVE-2025-8671 (CVSS 7.5 High).
MadeYouReset is an HTTP/2 DoS vulnerability disclosed in August 2025 by researchers at Tel Aviv University and Imperva. It exploits a mismatch between HTTP/2 stream accounting and internal backend processing in many popular server implementations.
The attack sends deliberately malformed HTTP/2 control frames (e.g. a WINDOW_UPDATE with increment=0, which is illegal per RFC 9113 §6.9.1) to coerce the server itself into issuing RST_STREAM frames. Because the server treats the stream as closed at the protocol level while continuing to process the request in the backend, an attacker can bypass the MAX_CONCURRENT_STREAMS limit and exhaust server resources — without sending a single client-side RST_STREAM.
This makes it a bypass of mitigations introduced for the earlier Rapid Reset attack (CVE-2023-44487).
Known affected software:
| Product | CVE |
|---|---|
| Apache Tomcat 9.x / 10.x / 11.x | CVE-2025-48989 |
| Netty < 4.1.124.Final / 4.2.4.Final | CVE-2025-55163 |
| F5 BIG-IP | CVE-2025-54500 |
| IBM WebSphere Application Server Liberty | CVE-2025-36047 |
| Varnish, Fastly, Jetty, SUSE, Wind River | CVE-2025-8671 |
h2 via ALPN.SETTINGS frame.HEADERS frame.WINDOW_UPDATE frame (increment=0) on the open stream.RST_STREAM on the stream (no GOAWAY) → likely vulnerable.GOAWAY → correct RFC behaviour; likely patched.The script performs a read-only passive probe — it does not attempt to exploit or stress-test the server.
git clone https://github.com/ayushghatkar8080/MadeYouReset_Tester.git
cd MadeYouReset_Tester
# No pip install needed — no dependencies
python3 main.py <url> [OPTIONS]
| Flag | Default | Description |
|---|---|---|
--timeout SECONDS | 8 | Socket read timeout |
--no-color | off | Disable ANSI colour output |
# Basic check
python3 main.py https://example.com
# Custom port and longer timeout
python3 main.py https://example.com:8443 --timeout 15
# CI-friendly (no colour)
python3 main.py https://example.com --no-color
| Code | Meaning |
|---|---|
0 | Not vulnerable — server responded with GOAWAY (correct RFC behaviour) |
1 | Likely vulnerable — server sent RST_STREAM on the stream but no GOAWAY |
2 | Inconclusive — no HTTP/2, connection error, or ambiguous response |
Exit codes make it straightforward to integrate into CI pipelines or automation scripts.
========================================================
MadeYouReset (CVE-2025-8671) Checker
========================================================
Target : https://vulnerable-server.example.com
Host : vulnerable-server.example.com:443
Path : /
Timeout : 8.0s
────────────────────────────────────────────────────────
[*] Connecting to vulnerable-server.example.com:443 ...
✓ TCP connection established
[*] Performing TLS handshake (ALPN: h2, http/1.1) ...
→ Negotiated protocol : h2
✓ HTTP/2 (h2) negotiated via ALPN
[*] Sending HTTP/2 client preface ...
✓ Preface + SETTINGS sent
[*] Waiting for server SETTINGS ...
← Frame type=0x04 stream=0 length=18
✓ Server SETTINGS received
✓ Sent SETTINGS ACK
[*] Opening HTTP/2 stream 1 (HEADERS frame) ...
✓ HEADERS sent on stream 1
[*] Sending malformed WINDOW_UPDATE (increment=0) on stream 1 ...
RFC 9113 §6.9.1: increment=0 is a stream-level FLOW_CONTROL_ERROR
✓ Malformed WINDOW_UPDATE sent
[*] Analysing server response (timeout=8.0s) ...
← RST_STREAM stream=1 error_code=0x00000003
────────────────────────────────────────────────────────
RESULT
────────────────────────────────────────────────────────
[LIKELY VULNERABLE]
Server responded with RST_STREAM on stream 1
(error_code=0x00000003) but did NOT send GOAWAY.
Recommended actions:
• Patch: Apache Tomcat ≥10.1.44/11.0.10/9.0.108,
Netty ≥4.1.124.Final / 4.2.4.Final,
and other vendor advisories for CVE-2025-8671.
• Interim: disable HTTP/2 or deploy a WAF/proxy that
validates HTTP/2 frames before forwarding.
========================================================
| Action | Details |
|---|---|
| Patch | Apply the latest vendor update for your HTTP/2 stack (see table above) |
| Disable HTTP/2 | Fall back to HTTP/1.1 as a temporary mitigation |
| WAF / Proxy | Deploy a reverse proxy or WAF that validates HTTP/2 frames at the edge |
| Rate limiting | Enforce per-client connection caps and RST_STREAM rate limits |
This tool is intended for authorized security testing and research only.
Do not run this script against systems you do not own or have explicit written permission to test.
The authors accept no liability for misuse.