A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-7f36ec4c65 advisory.

    Update to latest 7.7.x release available, a security release. Includes fixes for VSV00017 aka     CVE-2025-8671, aAdded patches for for VSV00018 aka CVE-2026-34475, added patches for for VSV00019.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6303 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6303-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     May 27, 2026                          https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : varnish     CVE ID         : CVE-2025-8671

    Two security issues were discovered in the the Varnish web accelerator,     which could result in cache poisoning or authentication bypass.

    For the stable distribution (trixie), this problem has been fixed in     version 7.7.0-3+deb13u1.

    We recommend that you upgrade your varnish packages.

    For the detailed security status of varnish please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/varnish

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0888-1 advisory.

    Update to dnsdist 1.9.11:

    - CVE-2025-8671: Add mitigations for the HTTP/2 MadeYouReset attack (bsc#1253852).
    - CVE-2025-30187: denial of service via crafted DoH exchange (bsc#1250054).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8037-1 advisory.

    It was discovered that HTTP/2, which is used/vendored by DNSdist, did not properly account for resources     when handling client-triggered stream

    resets. An attacker could possibly use this issue to cause a

    denial of service. (CVE-2025-8671)

    It was discovered that DNSdist did not properly manage memory limits when handling an unlimited number of     queries on a single TCP connection. An

    attacker could possibly use this issue to cause a denial of service. (CVE-2025-30193)

    It was discovered that DNSdist, when configured with the nghttp2 library, did not correctly process     certain DNS over HTTPS queries. An attacker could possibly use this cause a denial of service.
    (CVE-2025-30187)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005271 advisory.

    A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the     internal architectures of some HTTP/2 implementations may result in excessive server resource consumption     leading to denial-of-service (DoS).  By opening streams and then rapidly triggering the server to reset     themusing malformed frames or flow control errorsan attacker can exploit incorrect stream     accounting. Streams reset by the server are considered closed at the protocol level, even though backend     processing continues. This allows a client to cause the server to handle an unbounded number of concurrent     streams on a single connection. This CVE will be updated as affected product details are released.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Impact Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which
    could cause it to send data at a rate faster than the path might actually support. An unauthenticated
    remote attacker can exploit the vulnerability by first completing a handshake and initiating a congestion-
    controlled data transfer towards itself. Then, it could manipulate the victim's congestion control state
    by sending ACK frames exercising an opportunistic ACK attack; see RFC 9000 Section 21.4. The victim could
    grow the congestion window beyond typical expectations and allow more bytes in flight than the path might
    really support. Patches quiche 0.24.4 is the earliest version containing the fix for this issue.
    (CVE-2025-4820)

  - Impact Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which
    could cause it to send data at a rate faster than the path might actually support. An unauthenticated
    remote attacker can exploit the vulnerability by first completing a handshake and initiating a congestion-
    controlled data transfer towards itself. Then, it could manipulate the victim's congestion control state
    by sending ACK frames covering a large range of packet numbers (including packet numbers that had never
    been sent); see RFC 9000 Section 19.3. The victim could grow the congestion window beyond typical
    expectations and allow more bytes in flight than the path might really support. In extreme cases, the
    window might grow beyond the limit of the internal variable's type, leading to an overflow panic. Patches
    quiche 0.24.4 is the earliest version containing the fix for this issue. (CVE-2025-4821)

  - Cloudflare quiche was discovered to be vulnerable to an infinite loop when sending packets containing
    RETIRE_CONNECTION_ID frames. QUIC connections possess a set of connection identifiers (IDs); see Section
    5.1 of RFC 9000 https://datatracker.ietf.org/doc/html/rfc9000#section-5.1 . Once the QUIC handshake
    completes, a local endpoint is responsible for issuing and retiring Connection IDs that are used by the
    remote peer to populate the Destination Connection ID field in packets sent from remote to local. Each
    Connection ID has a sequence number to ensure synchronization between peers. An unauthenticated remote
    attacker can exploit this vulnerability by first completing a handshake and then sending a specially-
    crafted set of frames that trigger a connection ID retirement in the victim. When the victim attempts to
    send a packet containing RETIRE_CONNECTION_ID frames, Section 19.16 of RFC 9000
    https://datatracker.ietf.org/doc/html/rfc9000#section-19.6 requires that the sequence number of the
    retired connection ID must not be the same as the sequence number of the connection ID used by the packet.
    In other words, a packet cannot contain a frame that retires itself. In scenarios such as path migration,
    it is possible for there to be multiple active paths with different active connection IDs that could be
    used to retire each other. The exploit triggered an unintentional behaviour of a quiche design feature
    that supports retirement across paths while maintaining full connection ID synchronization, leading to an
    infinite loop.This issue affects quiche: from 0.15.0 before 0.24.5. (CVE-2025-7054)

  - A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the
    internal architectures of some HTTP/2 implementations may result in excessive server resource consumption
    leading to denial-of-service (DoS). By opening streams and then rapidly triggering the server to reset
    them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting.
    Streams reset by the server are considered closed at the protocol level, even though backend processing
    continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on
    a single connection. This CVE will be updated as affected product details are released. (CVE-2025-8671)

  - In some circumstances, when DNSdist is configured to use the nghttp2 library to process incoming DNS over
    HTTPS queries, an attacker might be able to cause a denial of service by crafting a DoH exchange that
    triggers an unbounded I/O read loop, causing an unexpected consumption of CPU resources. (CVE-2025-30187)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-2ff6e32273 advisory.

    Automatic update for varnish-7.7.3-2.fc44.

    ##### **Changelog**

    ```
    * Wed Oct 29 2025 Lubo Uhliarik <luhliari@redhat.com> - 7.7.3-2
    - Add tmpfiles.d rules for /var directories (bootc compatibility)
    * Mon Sep 15 2025 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.7.3-1
    - New upstream release: A security release
    - Includes fix for VSV00017 aka CVE-2025-8671, rhbz#2388222
    * Thu Jul 31 2025 Lubo Uhliarik <luhliari@redhat.com> - 7.7.1-4
    - bundle jemalloc in RHEL
    * Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 7.7.1-3
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
    * Thu May 22 2025 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.7.1-2
    - Correct ABI and VRT versions
    - Pulled el7 support
    - Use systemd setup for users
    * Tue May 20 2025 Lubo Uhliarik <luhliari@redhat.com> - 7.7.1-1
    - new version 7.7.1
    * Thu Mar 27 2025 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.7.0-2
    - Fix for eln build (merged from yselkowitz)
    - Fix for failing h2 switch check. Enabling full test suite again
    * Mon Mar 24 2025 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.7.0-1
    - New upstream release
    - fedora now has completed the bin/sbin merge
    * Sun Jan 19 2025 Fedora Release Engineering <releng@fedoraproject.org> - 7.6.1-2
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
    * Mon Dec  2 2024 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.6.1-1
    - New upstream release
    * Mon Sep 16 2024 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.6.0-1
    - New upstream release
    - Updated checkout of pkg-varnish
    * Sat Jul 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 7.5.0-2
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
    * Tue Mar 19 2024 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.5.0-1
    - New upstream release
    - Moved somethings around to make the diff from the upstream spec less
    - Upped some memory requirements in some of the tests. Necessary on aarch64 and ppc64le (and ppc32)
    - Reduced number of parallel jobs on s390x builders as builds tend to fail when stressed
    - Retired armv7hl
    * Sat Jan 27 2024 Fedora Release Engineering <releng@fedoraproject.org> - 7.4.2-2
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
    * Wed Nov  8 2023 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.4.2-1
    - New upstream release. A security release
    - Includes fix for CVE-2023-44487 aka VSV00013, rhbz#2243328, HTTP/2 Rapid Reset Attack

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the
    internal architectures of some HTTP/2 implementations may result in excessive server resource consumption
    leading to denial-of-service (DoS). By opening streams and then rapidly triggering the server to reset
    them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting.
    Streams reset by the server are considered closed at the protocol level, even though backend processing
    continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on
    a single connection. This CVE will be updated as affected product details are released. (CVE-2025-8671)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the     internal architectures of some HTTP/2 implementations may result in excessive server resource consumption     leading to denial-of-service (DoS). By opening streams and then rapidly triggering the server to reset     themusing malformed frames or flow control errorsan attacker can exploit incorrect stream accounting.
    Streams reset by the server are considered closed at the protocol level, even though backend processing     continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on     a single connection. This CVE will be updated as affected product details are released. (CVE-2025-8671)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the e2d49973-785a-11f0-a1c0-0050569f0b83 advisory.

    Varnish Development Team reports:
    A denial of service attack can be performed on Varnish Cache servers                    that have the HTTP/2 protocol turned on. An attacker can create a                    large number of streams and immediately reset them without ever                    reaching the maximum number of concurrent streams allowed for the                    session, causing the Varnish server to consume unnecessary                    resources processing requests for which the response will not be                    delivered.
    This attack is a variant of the HTTP/2 Rapid Reset Attack, which was                    partially handled as VSV00013.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
323998	Fedora 43 : collectd / varnish / varnish-modules / vmod-querystring (2026-7f36ec4c65)	Nessus	Fedora Local Security Checks	critical
307676	Debian dsa-6303 : libvarnishapi-dev - security update	Nessus	Debian Local Security Checks	high
302256	SUSE SLED15 / SLES15 Security Update : dnsdist (SUSE-SU-2026:0888-1)	Nessus	SuSE Local Security Checks	high
299040	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 : DNSdist vulnerabilities (USN-8037-1)	Nessus	Ubuntu Local Security Checks	high
298182	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: varnish (UTSA-2026-005271)	Nessus	Unity Linux Local Security Checks	high
436214	Alpine: multiple dnsdist packages: security update to 2.0.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
436214	Alpine: multiple dnsdist packages: security update to 2.0.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
272039	Fedora 44 : varnish (2025-2ff6e32273)	Nessus	Fedora Local Security Checks	medium
435496	Alpine: multiple lighttpd packages: security update to 1.4.81-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
435496	Alpine: multiple lighttpd packages: security update to 1.4.81-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
260016	Linux Distros Unpatched Vulnerability : CVE-2025-8671	Nessus	Misc.	high
433377	Alpine: multiple varnish packages: security update to 7.7.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
433377	Alpine: multiple varnish packages: security update to 7.7.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
249328	FreeBSD : www/varnish7 -- Denial of Service in HTTP/2 (e2d49973-785a-11f0-a1c0-0050569f0b83)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2025-8671

high

Tenable Plugins

critical

high

high

high

high

high

high

medium

high

high

high

high

high

high