5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-8grv-jq2g-cfhw

GHSA-8grv-jq2g-cfhw: amphp/http-server affected by HTTP/2 DDoS vulnerability

Versions of amphp/http-server prior to 3.4.4 for the 3.x release branch and prior to 2.1.10 for the 2.x release branch are vulnerable to the HTTP/2 "MadeYouReset" DoS attack described by CVE-2025-8671 and https://kb.cert.org/vuls/id/767506.

In versions 3.4.4 and 2.1.10, stream reset protection has been refactored to account for the number of reset streams within a sliding time window.

Note that your application must expose HTTP/2 connections directly to be affected by this vulnerability. Servers behind a proxy using HTTP/1.x such as nginx are not affected.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-8grv-jq2g-cfhw

GHSA-8grv-jq2g-cfhw:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
amphp/http-server	composer	>= 3.0.0-beta.1, < 3.4.4	3.4.4
amphp/http-server	composer	>= 2.0.0-rc1, < 2.1.10	2.1.10

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Denial of Service (DoS) attack on the HTTP/2 implementation in amphp/http-server, known as the "MadeYouReset" attack (related to CVE-2023-44487). An attacker can overwhelm the server by rapidly opening and then resetting a large number of HTTP/2 streams, consuming server resources for stream setup and teardown, which leads to a DoS.

The security patches (in versions 2.1.10 and 3.4.4) address this by introducing a rate-limiting mechanism. The core of the fix is in the Amp\Http\Server\Driver\Http2Driver::releaseStream function. This function is invoked when a stream is terminated, including when a client sends a RST_STREAM frame. The patch modifies this function to track the number of streams that are reset by the client within a sliding time window. If this number exceeds a defined threshold and ratio, the server proactively terminates the entire connection with an ENHANCE_YOUR_CALM error, thus mitigating the resource exhaustion attack.

The Amp\Http\Server\Driver\Http2Driver::handleHeaders function is also relevant as it's the entry point for creating the streams that an attacker would then reset. This function is a key part of the exploitation process and would be heavily invoked during an attack, making it a strong runtime indicator.

Vulnerable functions

Amp\Http\Server\Driver\Http2Driver::releaseStream

src/Driver/Http2Driver.php

This function is responsible for releasing stream resources. Before the patch, it did not have any mechanism to prevent a client from rapidly opening and resetting streams, leading to resource exhaustion (Denial of Service). The patch adds a rate-limiting mechanism that tracks the number of reset streams over a time window and closes the connection if a threshold is exceeded.

Amp\Http\Server\Driver\Http2Driver::handleHeaders

src/Driver/Http2Driver.php

This function is called to handle incoming HEADERS frames and create new HTTP/2 streams. An attacker would repeatedly call this function to open new streams that are subsequently reset to cause a Denial of Service. While the primary vulnerability is the lack of reset protection in `releaseStream`, this function is a necessary component of the attack chain and would appear in any runtime profile of the exploit.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.