PT-2025-33005 · Http/2 · Http/2

Published 2025-08-13 · Updated 2026-02-04 · CVE-2025-54500

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Affected versions not specified

Description: An implementation flaw in HTTP/2 can lead to a denial-of-service (DoS) condition. This occurs through the use of malformed HTTP/2 control frames, which disrupt the maximum concurrent streams limit, resulting in what is known as an HTTP/2 MadeYouReset Attack.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BDU:2025-10995

CVE-2025-54500

Affected Products

Http/2

References · 10

• https://bdu.fstec.ru/vul/2025-10995 · Security Note
• https://osv.dev/vulnerability/CVE-2025-54500 · Vendor Advisory
• https://my.f5.com/manage/s/article/K000152001 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54500 · Security Note
• https://t.me/CVEtracker/29896 · Telegram Post
• https://twitter.com/rst_cloud/status/1958263664630194246 · Twitter Post
• https://t.me/aptreports/21397 · Telegram Post
• https://t.me/cveNotify/150884 · Telegram Post
• https://twitter.com/CVEnew/status/1955658236960309357 · Twitter Post
• https://kb.cert.org/vuls/id/767506 · Note