Denial-of-Service Vulnerability in H2O and Varnish Packages
Summary
CVE-2025-8671: A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to d... Affects varnish across 2 version ranges.
< 7.7.2-r0
< 4729b661e3c6654198d2cc62997e1af58bef4b80
Fixed in 7.7.2-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
H2O is an open-source HTTP/2 server designed for high performance and scalability, while Varnish is a web application accelerator known for its caching capabilities. Both packages are widely used in web server environments to enhance performance and manage traffic efficiently. However, they are susceptible to a vulnerability that can lead to excessive resource consumption, potentially causing denial-of-service (DoS) conditions.
Vulnerability Detail
CVE-2025-8671 is a vulnerability that arises from a mismatch between HTTP/2 specifications and the internal architectures of certain HTTP/2 implementations. This issue allows an attacker to exploit the server by rapidly triggering resets of streams, which can lead to unbounded concurrent streams on a single connection. The result is excessive server resource consumption, which may lead to service outages and degraded performance.
How To Fix
Minimum fixed version
7.7.2-r0
This is the first release that contains the fix.
sudo apk add --upgrade varnishTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider limiting the number of concurrent streams that can be opened by clients or implementing rate limiting to mitigate the impact of this vulnerability until a patch can be applied.
Conclusion
CVE-2025-8671 poses a significant risk to H2O and Varnish packages, leading to potential denial-of-service conditions. It is crucial for users to update their packages to the patched versions and consider workarounds to minimize risk until updates can be applied.
See every vulnerability recorded for varnish →
FAQ
CVE-2025-8671 is a vulnerability affecting H2O and Varnish packages that can lead to denial-of-service conditions due to excessive resource consumption.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
The vulnerability can lead to service outages and degraded performance as attackers can exploit it to consume excessive server resources.
Yes, patches are available for both H2O and Varnish. Ensure you update to the latest versions as specified in the 'how to fix' section.
If immediate patching is not possible, consider implementing rate limiting or restricting the number of concurrent streams to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for varnish.
