Apache Tomcat "Made You Reset" vulnerability exposes risk of Denial-of-Service attacks
Take action: If you're running Apache Tomcat, review this vulnerability. It's not an urgent patch, but if you are running a vulnerable version, either plan a patch cycle or be aware that the DoS attack can happen and your systems will succumb to it. Discuss internally, whether this is a high risk for you.
Learn More
he Apache Software Foundation is reporting a vulnerability in Apache Tomcat's HTTP/2 implementation that could enable attackers to launch devastating denial-of-service attacks against web servers worldwide.
This flaw is tracked as CVE-2025-48989 (CVSS score 7.5) is part of a broader HTTP/2 protocol vulnerability known as "Made You Reset" that affects multiple implementations across the web infrastructure.
The "Made You Reset" attack is an evolution of the "Rapid Reset" attacks (CVE-2023-44487) in 2023. Rapid Reset abused client-sent stream resets. The new technique tricks the server into canceling requests automatically. By opening streams and then rapidly triggering the server to reset them using malformed frames or flow control errors, attackers can exploit incorrect stream accounting, allowing clients to cause servers to handle an increasing number of concurrent streams on a single connection, causing an overload and crash.
The vulnerability affects Apache Tomcat 11.0.0-M1 through 11.0.9, Apache Tomcat 10.1.0-M1 through 10.1.43, and Apache Tomcat 9.0.0.M1 through 9.0.107. Older end-of-life versions may also be vulnerable but are not confirmed.
The broader "Made You Reset" vulnerability, tracked as CVE-2025-8671, affects numerous HTTP/2 implementations including AMPHP, Apache Tomcat, Eclipse Foundation projects, F5 Networks, Fastly, gRPC, Mozilla services, Netty, SUSE Linux, Varnish Software, Wind River, and Zephyr Project.
The Apache Software Foundation has released patches to address this vulnerability across all affected Tomcat versions. Organizations should upgrade to the following fixed versions:
- Apache Tomcat 11.0.10 or later (fixes versions 11.0.0-M1 through 11.0.9)
- Apache Tomcat 10.1.44 or later (fixes versions 10.1.0-M1 through 10.1.43)
- Apache Tomcat 9.0.108 or later (fixes versions 9.0.0.M1 through 9.0.107)
There are no effective workarounds available for CVE-2025-48989.
The coordinated disclosure has resulted in patches from multiple vendors, with Fastly implementing fixes in release 25.17 deployed across their infrastructure on June 2, 2025, and Varnish Software releasing patches for Cache 7.6.4, 7.7.2, and Enterprise 6.0.14r5. However, the vulnerability's broad impact across HTTP/2 implementations highlights the ongoing challenges in protocol security as performance optimizations can inadvertently create new attack vectors.
No evidence of active exploitation has been reported, but the public disclosure of technical details and proof-of-concept code increases the probability of attacks.
