PoC-CVE-2025-8671-MadeYouReset-HTTP-2

PoC to validate MadeYouReset vulnerability

This repository contains a controlled PoC developed to validate whether an infrastructure is potentially vulnerable to CVE-2025-8671 (MadeYouReset). The code is not a full exploit and does not perform real DoS – the goal is only to simulate the publicly described vectors and observe server responses.

About CVE-2025-8671 CVE-2025-8671 affects HTTP/2 implementations where the server does not properly handle certain invalid frames sent after stream or connection closure. An attacker could exploit the flaw to cause excessive CPU/memory consumption, resulting in denial of service (DoS).

The most common publicly described vectors include:

• Invalid WINDOW_UPDATE (on nonexistent stream or connection with zero window)
• DATA sent after END_STREAM
• Zero-length HEADERS after stream closure
• PRIORITY with invalid length after closure
• CONTINUATION without prior HEADERS

What the code does The script:

1. Establishes an HTTP/2 connection with the target.

2. Executes requests for the known vectors (listed above).

3. Monitors the server response, recording events such as:

   • GOAWAY (connection closure by the server)
   • RST_STREAM (proper reset of the invalid stream)
   • Early connection closure
   • Received responses (when the server processes the request)
   • Internal errors

4. For each attempt, it outputs JSON with:

   • vector → tested attack vector
   • attempt → attempt number
   • rst_stream → whether the server reset the stream
   • goaway → whether the server closed the connection
   • responses → whether there was a server response
   • conn_closed_early → whether the connection was closed earlier than expected
   • error → locally captured error message

Limitations

• The script is not a real DoS exploit. It only sends a few dozen frames per vector for controlled detection.

• The code does not directly measure server CPU/memory exhaustion; analysis depends on:

  • Server-side logs, CDN or backend
  • Response time metrics, bytes sent, and status codes

• It does not cover all possible exploitation scenarios, only the vectors already publicly described.

• It is a defensive validation tool, not an attack tool.

How to use

Requirements

• Python 3.10 or higher
• Dependencies: pip install h2 hyperframe

Execution

python3 poc_cve.py

Result Interpretation

GOAWAY = 1 → the server properly closed the connection. RST_STREAM = 1 → the server properly reset the invalid stream. responses > 0 → the server processed the request (acceptable on valid paths, provided it closes afterward). conn_closed_early = 1 → the server closed the connection immediately (normal for some vectors). error → indicates local client error (not necessarily a server issue).

Non-vulnerable infrastructures typically:

Close the connection (GOAWAY) or reset invalid streams (RST_STREAM)

Do not keep active processing after the invalid frames

Do not show slowness or anomalous consumption in logs

Conclusion

This code allows safe and non-intrusive validation of whether an HTTP/2 infrastructure reacts properly to the vectors associated with CVE-2025-8671.

It fulfills its purpose as a defensive PoC: detecting incorrect behaviors without generating real DoS or exploiting the flaw in production.