amphp/http-server affected by HTTP/2 DDoS vulnerability
The advisory, in context
Versions of amphp/http-server prior to 3.4.4 for the 3.x release branch and prior to 2.1.10 for the 2.x release branch are vulnerable to the HTTP/2 "MadeYouReset" DoS attack described by CVE-2025-8671 and https://kb.cert.org/vuls/id/767506.
In versions 3.4.4 and 2.1.10, stream reset protection has been refactored to account for the number of reset streams within a sliding time window.
Note that your application must expose HTTP/2 connections directly to be affected by this vulnerability. Servers behind a proxy using HTTP/1.x such as nginx are not affected.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 3.0.0-beta.1 before 3.4.4
Fixed in 3.4.4
17 explicitly affected versions
v3.0.0, v3.0.0-beta.1, v3.0.0-beta.2, v3.0.0-beta.3, v3.0.0-beta.4, v3.0.0-beta.5, v3.0.0-beta.6, v3.0.0-beta.7, v3.0.0-beta.8, v3.1.0, v3.2.0, v3.3.0, v3.3.1, v3.4.0, v3.4.1, v3.4.2, v3.4.3
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "3.0.0-beta.1"
},
{
"fixed": "3.4.4"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v3.0.0",
"v3.0.0-beta.1",
"v3.0.0-beta.2",
"v3.0.0-beta.3",
"v3.0.0-beta.4",
"v3.0.0-beta.5",
"v3.0.0-beta.6",
"v3.0.0-beta.7",
"v3.0.0-beta.8",
"v3.1.0",
"v3.2.0",
"v3.3.0",
"v3.3.1",
"v3.4.0",
"v3.4.1",
"v3.4.2",
"v3.4.3"
]
}From 2.0.0-rc1 before 2.1.10
Fixed in 2.1.10
16 explicitly affected versions
v2.0.0, v2.0.0-rc1, v2.0.0-rc2, v2.0.0-rc3, v2.0.0-rc4, v2.0.1, v2.1.0, v2.1.1, v2.1.2, v2.1.3, v2.1.4, v2.1.5, v2.1.6, v2.1.7, v2.1.8, v2.1.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2.0.0-rc1"
},
{
"fixed": "2.1.10"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v2.0.0",
"v2.0.0-rc1",
"v2.0.0-rc2",
"v2.0.0-rc3",
"v2.0.0-rc4",
"v2.0.1",
"v2.1.0",
"v2.1.1",
"v2.1.2",
"v2.1.3",
"v2.1.4",
"v2.1.5",
"v2.1.6",
"v2.1.7",
"v2.1.8",
"v2.1.9"
]
}