{
  "cveId": "CVE-2025-8671",
  "url": "https://patchblox.com/security/cve/CVE-2025-8671",
  "summary": "CVE-2025-8671 is fixed in 2 products on 1 platform, first by dnsdist 1.8.3-2ubuntu0.1~esm1, released August 13, 2025. It is not reported as exploited. Patch Radar priority: High.",
  "title": "varnish: A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal archit...",
  "description": "A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS).  By opening streams and then rapidly triggering the server to reset them\u2014using malformed frames or flow control errors\u2014an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.",
  "published": "2025-08-13T06:15:00Z",
  "severity": "high",
  "cvss": 7.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.03637,
  "epssPercentile": 0.89629,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "dnsdist",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "1.8.3-2ubuntu0.1~esm1",
      "fix": "dnsdist 1.8.3-2ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-dnsdist-1.8.3-2ubuntu0.1-esm1",
      "released": "2025-08-13T06:15:00Z"
    },
    {
      "platform": "linux",
      "product": "dnsdist",
      "release": "Ubuntu 25.10 (questing)",
      "fixedVersion": "1.9.10-1ubuntu0.1",
      "fix": "dnsdist 1.9.10-1ubuntu0.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-questing-dnsdist-1.9.10-1ubuntu0.1",
      "released": "2025-09-18T03:15:00Z"
    },
    {
      "platform": "linux",
      "product": "dnsdist",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "1.9.11-160000.1.1",
      "fix": "OPENSUSE-SU-2026:20461-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-20461-1",
      "released": "2026-04-02T09:11:51Z"
    },
    {
      "platform": "linux",
      "product": "dnsdist",
      "release": "sles 15.7",
      "fixedVersion": "1.9.11-150700.3.6.1",
      "fix": "SUSE-SU-2026:0888-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0888-1",
      "released": "2026-03-13T07:08:03Z"
    },
    {
      "platform": "linux",
      "product": "dnsdist",
      "release": "sles 16.0",
      "fixedVersion": "1.9.11-160000.1.1",
      "fix": "SUSE-SU-2026:20995-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-20995-1",
      "released": "2026-04-02T09:16:22Z"
    },
    {
      "platform": "linux",
      "product": "varnish",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "7.7.0-3\u002Bdeb13u1",
      "fix": "DEBIAN-CVE-2025-8671",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-8671",
      "released": "2025-08-13T13:15:34Z"
    },
    {
      "platform": "linux",
      "product": "varnish",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "7.7.3-bp160.1.1",
      "fix": "OPENSUSE-SU-2026:22131-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-22131-1",
      "released": "2026-11-07T00:47:19Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}