A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-2ff6e32273 advisory.

    Automatic update for varnish-7.7.3-2.fc44.

    ##### **Changelog**

    ```
    * Wed Oct 29 2025 Lubo Uhliarik <luhliari@redhat.com> - 7.7.3-2
    - Add tmpfiles.d rules for /var directories (bootc compatibility)
    * Mon Sep 15 2025 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.7.3-1
    - New upstream release: A security release
    - Includes fix for VSV00017 aka CVE-2025-8671, rhbz#2388222
    * Thu Jul 31 2025 Lubo Uhliarik <luhliari@redhat.com> - 7.7.1-4
    - bundle jemalloc in RHEL
    * Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 7.7.1-3
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
    * Thu May 22 2025 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.7.1-2
    - Correct ABI and VRT versions
    - Pulled el7 support
    - Use systemd setup for users
    * Tue May 20 2025 Lubo Uhliarik <luhliari@redhat.com> - 7.7.1-1
    - new version 7.7.1
    * Thu Mar 27 2025 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.7.0-2
    - Fix for eln build (merged from yselkowitz)
    - Fix for failing h2 switch check. Enabling full test suite again
    * Mon Mar 24 2025 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.7.0-1
    - New upstream release
    - fedora now has completed the bin/sbin merge
    * Sun Jan 19 2025 Fedora Release Engineering <releng@fedoraproject.org> - 7.6.1-2
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
    * Mon Dec  2 2024 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.6.1-1
    - New upstream release
    * Mon Sep 16 2024 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.6.0-1
    - New upstream release
    - Updated checkout of pkg-varnish
    * Sat Jul 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 7.5.0-2
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
    * Tue Mar 19 2024 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.5.0-1
    - New upstream release
    - Moved somethings around to make the diff from the upstream spec less
    - Upped some memory requirements in some of the tests. Necessary on aarch64 and ppc64le (and ppc32)
    - Reduced number of parallel jobs on s390x builders as builds tend to fail when stressed
    - Retired armv7hl
    * Sat Jan 27 2024 Fedora Release Engineering <releng@fedoraproject.org> - 7.4.2-2
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
    * Wed Nov  8 2023 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.4.2-1
    - New upstream release. A security release
    - Includes fix for CVE-2023-44487 aka VSV00013, rhbz#2243328, HTTP/2 Rapid Reset Attack

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the     internal architectures of some HTTP/2 implementations may result in excessive server resource consumption     leading to denial-of-service (DoS). By opening streams and then rapidly triggering the server to reset     themusing malformed frames or flow control errorsan attacker can exploit incorrect stream accounting.
    Streams reset by the server are considered closed at the protocol level, even though backend processing     continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on     a single connection. This CVE will be updated as affected product details are released. (CVE-2025-8671)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the e2d49973-785a-11f0-a1c0-0050569f0b83 advisory.

    Varnish Development Team reports:
    A denial of service attack can be performed on Varnish Cache servers                    that have the HTTP/2 protocol turned on. An attacker can create a                    large number of streams and immediately reset them without ever                    reaching the maximum number of concurrent streams allowed for the                    session, causing the Varnish server to consume unnecessary                    resources processing requests for which the response will not be                    delivered.
    This attack is a variant of the HTTP/2 Rapid Reset Attack, which was                    partially handled as VSV00013.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
272039	Fedora 44 : varnish (2025-2ff6e32273)	Nessus	Fedora Local Security Checks	medium
260016	Linux Distros Unpatched Vulnerability : CVE-2025-8671	Nessus	Misc.	high
249328	FreeBSD : www/varnish7 -- Denial of Service in HTTP/2 (e2d49973-785a-11f0-a1c0-0050569f0b83)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2025-8671

high

Tenable Plugins

medium

high

high