A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the     internal architectures of some HTTP/2 implementations may result in excessive server resource consumption     leading to denial-of-service (DoS). By opening streams and then rapidly triggering the server to reset     themusing malformed frames or flow control errorsan attacker can exploit incorrect stream accounting.
    Streams reset by the server are considered closed at the protocol level, even though backend processing     continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on     a single connection. This CVE will be updated as affected product details are released. (CVE-2025-8671)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the e2d49973-785a-11f0-a1c0-0050569f0b83 advisory.

    Varnish Development Team reports:
    A denial of service attack can be performed on Varnish Cache servers                    that have the HTTP/2 protocol turned on. An attacker can create a                    large number of streams and immediately reset them without ever                    reaching the maximum number of concurrent streams allowed for the                    session, causing the Varnish server to consume unnecessary                    resources processing requests for which the response will not be                    delivered.
    This attack is a variant of the HTTP/2 Rapid Reset Attack, which was                    partially handled as VSV00013.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
260016	Linux Distros Unpatched Vulnerability : CVE-2025-8671	Nessus	Misc.	high
249328	FreeBSD : www/varnish7 -- Denial of Service in HTTP/2 (e2d49973-785a-11f0-a1c0-0050569f0b83)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2025-8671

high

Tenable Plugins

high

high