CVE-2025-54500

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An HTTP/2 implementation flaw allows a denial-of-service (DoS) that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit (HTTP/2 MadeYouReset Attack).

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published: Aug 13, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-545015.9Improper access control on an internal debug interface could allow a high privileged attacker to bypass memory access controls potentially r CVE-2025-545027.5Incorrect use of boot service in the AMD Platform Configuration Blob (APCB) SMM driver could allow a privileged attacker with local access (CVE-2025-545035.9Improper handling of overlap between protected memory ranges in the Secure Encrypted Virtualization (SEV) firmware could allow a privileged CVE-2025-545045.9Insufficient Granularity of Access Control in AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with administrative CVE-2025-545052.0A transient execution vulnerability within AMD CPUs may allow a local user-privileged attacker to leak data via the floating point divisor u CVE-2025-545064.0A time-of-check to time-of-use (TOCTOU) race condition in the AMD SEV Secure Encrypted Virtualization (SEV) firmware could allow an attacker CVE-2025-545075.9Improper validation of consistency within input in AMD SEV (Secure Encrypted Virtualization) firmware could allow an attacker with administr CVE-2025-545084.0Improper validation of Reverse Map Table (RMP) entries in the Secure Encrypted Virtualization (SEV) firmware could allow a privileged attack CVE-2025-545094.0Improper access control for register interface in the Input-Output Memory Management Unit (IOMMU) could allow a privileged attacker to cause CVE-2025-54514.9A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a rem CVE-2025-545105.9A missing lock verification in AMD Secure Processor (ASP) firmware may permit a locally authenticated attacker with administrative privilege CVE-2025-545115.3Improper handling of insufficient privileges in the AMD Secure Processor (ASP) could allow an attacker to provide an input value to a functi