MadeYouReset is a new HTTP2 vulnerability that exploits a common design flaw in HTTP2 implementation, enabling attackers to launch massive DoS attacks. The flaw has been assigned multiple CVEs, and corresponding patches have been released by many vendors.
MadeYouReset is comparable in power and core problem to the notorious Rapid Reset zero-day vulnerability which was exploited in 2023 and ultimately crashed large-scale services. DoS attacks are among the most serious threats to the Internet, overwhelming systems until legitimate users are denied access and causing significant disruption and losses.
HTTP2 powers much of today’s web, with over 60% of top sites using it and carrying about a third of global HTTP traffic. Its central role makes HTTP2 servers prime targets for DoS attacks.
Operationally, MadeYouReset bypasses the typical server-imposed limit of 100 concurrent HTTP2 requests per TCP connection from a client. This limit is intended to mitigate DoS attacks by restricting the number of simultaneous requests a client can send. With MadeYouReset, an attacker can send many thousands of requests, creating a denial-of-service condition for legitimate users and, in some vendor implementations, escalating into out-of-memory crashes.
This work highlights the importance of collaboration between the cybersecurity academic and industry communities. The discovery is part of research conducted at Tel-Aviv University. We thank CERT/CC for managing the disclosure process and the vendors for helpful feedback. This research is partly supported by Imperva.