[UPDATE] [medium] http/2 Implementations: Vulnerability enables Denial of Service

mediumCVE-2025-8671 CVE-2025-48989 CVE-2025-5115 CVE-2025-55163

A remote, anonymous attacker can exploit a vulnerability in various http/2 implementations to perform a Denial of Service attack.

CSIRTS triage

Denial of service

What: A vulnerability affecting multiple HTTP/2 implementations allows a remote attacker to trigger a Denial of Service condition.
Who is affected: Systems and applications using HTTP/2 implementations across multiple libraries and products.
Urgency: Medium severity; distributed across many implementations and currently unexploited.
Action: Identify and update all HTTP/2 implementations in use to patched versions.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source: CERT-Bund (BSI) Security Advisories (DE · national-cert · site)
Severity: medium
Published: 2026-09-02
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-1830

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Moderate exploitation riskCVE-2025-86713.5% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 89% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2025-489893.5% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 89% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2025-51153.5% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 88% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2025-551631.0% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 62% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2025-8671	coverage & exploitation status	NVD · CVE.org
CVE-2025-48989	coverage & exploitation status	NVD · CVE.org
CVE-2025-5115	coverage & exploitation status	NVD · CVE.org
CVE-2025-55163	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

high[UPDATE] [high] Dell NetWorker (Third Party Components): Multiple vulnerabilitiescert-bund
criticalexploited[UPDATE] [critical] Oracle Fusion Middleware: Multiple Vulnerabilitiescert-bund
unknownUSN-8654-1: Netty vulnerabilitiesubuntu
unknownMultiple vulnerabilities in IBM products (July 24, 2026)cert-fr-avis
high[NEW] [high] Dell PowerProtect Data Domain: Multiple vulnerabilitiescert-bund
unknownJenkins Security Advisory 2025-09-17jenkins

Recent advisories for http/2 Implementations

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

highCVE-2026-85197: A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle (MITM) attacker …nvd · 2026-09-04
unknownCVE-2026-84304: gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transpo…nvd · 2026-09-01
high[UPDATE] [high] HTTP/2 implementations: Vulnerability allows denial of servicecert-bund · 2026-09-01
highexploited[UPDATE] [high] http/2 implementations: Vulnerability allows denial of servicecert-bund · 2026-08-14
mediumCVE-2026-71554: h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.…nvd · 2026-08-06
mediumCVE-2026-15713: A vulnerability was found in libsoup's HTTP/2 protocol implementation. The library fails to co…nvd · 2026-07-14