CVE-2025-8671: fastly h20 Improper Resource Shutdown or Release
Vulnerability summary
CVE-2025-8671 is a high (CVSS 7.5) Improper Resource Shutdown or Release vulnerability in fastly h20. EPSS estimates a 3.62% chance of exploitation in the next 30 days, higher than 89.3% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 4 · Related 4Timeline
- 13-08-2025PublishedVulnerability first disclosed.
- 04-11-2025Last modifiedVulnerability information updated.
Description
A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
3.62%
Chance of exploitation in the next 30 days
Percentile
89%
Versus all other CVEs
30-day change
+0.11 pp
From 3.51% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Suse linux13 products
- enterprise desktop≥ 15 SP6, < 15 SP7
- enterprise high performance computing≥ 15 SP3, < 15 SP7
- enterprise high performance computing (hpc)≥ 15, < 15 SP5
- enterprise module for dev tools≥ 15 SP3, < 15 SP7
- enterprise module for development tools≥ 15 SP2, < 15-SP5
Ubuntu4 products
- dnsdist< 1.8.3-2ubuntu0.1~esm1 | < 1.9.10-1ubuntu0.1
- h2oAll versions (No fix recorded)
- lighttpdAll versions (No fix recorded)
- varnishAll versions (No fix recorded)
Alpine2 products
- lighttpd< 0-r0
- varnish< 7.7.2-r0
Debian2 products
- h2oAll versions (No fix recorded)
- varnishAll versions (No fix recorded) | < 7.7.0-3+deb13u1
Mageia2 products
- lighttpd< 1.4.80-1.3.mga9
- varnish< 7.7.3-1.mga9
Opensuse2 products
- dnsdist&distro=openSUSE Tumbleweed< 2.0.2-1.1
- lighttpd&distro=openSUSE Tumbleweed< 1.4.80-1.1
Varnish software2 products
- varnish cache≥ 6.0LTS, ≤ 6.014 | ≥ 5.x, ≤ 7.71
- varnish enterprise≥ 6.0.x, ≤ 6.0.14r4
Crates.Io1 product
- pingora-core≥ 0.0.0-0, < 0.6.0
Fastly1 product
- h20579ecfa
Wind river1 product
- linux≥ LTS22, ≤ TLS25
10 vendors · 30 products
