CVE-2025-54500: 
F5 BIG-IP Advanced Firewall Manager vulnerability analysis and mitigation

CVE-2025-54500 is an HTTP/2 implementation flaw in F5 BIG-IP products that enables a denial-of-service (DoS) attack known as the "MadeYouReset" attack. By sending malformed HTTP/2 control frames, an unauthenticated remote attacker can break the SETTINGS_MAX_CONCURRENT_STREAMS limit, causing the server to process an unbounded number of concurrent HTTP/2 requests. The vulnerability was disclosed on August 13, 2025, and affects F5 BIG-IP across multiple product lines in versions 15.1.x, 16.1.x, 17.1.x, and 17.5.x, as well as BIG-IP Next and BIG-IP Next CNF variants. It carries a CVSS v3.1 base score of 5.3 (Medium) (F5 Advisory, Red Hat CVE).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). The MadeYouReset attack exploits a mismatch between the HTTP/2 protocol specification and real-world server implementations: when a server sends a RST_STREAM frame to reset a stream (e.g., in response to a malformed frame or flow control error), the protocol considers that stream closed and removes it from the concurrent stream counter. However, the backend server continues processing the associated request. An attacker can repeatedly open streams and trigger server-side resets using malformed HTTP/2 control frames, causing the server to process an effectively unbounded number of concurrent requests on a single connection while the protocol-level stream counter remains within limits. No authentication or special privileges are required — the attack is network-accessible with low complexity (CERT/CC VU#767506, Red Hat Bugzilla). The vulnerability is closely related to CVE-2023-44487 ("Rapid Reset"), but differs in that it abuses server-sent resets rather than client-sent resets (CERT/CC VU#767506).

Successful exploitation results in resource exhaustion on the affected F5 BIG-IP system, manifesting as high CPU overload or memory exhaustion depending on the implementation. This can render the device unable to process legitimate traffic, effectively taking it offline or severely degrading service availability. There is no confidentiality or integrity impact — the vulnerability is purely a denial-of-service condition. Given that BIG-IP appliances are commonly deployed as load balancers and application delivery controllers in enterprise and critical infrastructure environments, a successful attack could disrupt services for large numbers of downstream users (F5 Advisory, CERT/CC VU#767506).

1. Reconnaissance: Identify internet-facing F5 BIG-IP appliances running affected versions (15.1.x before 15.1.10.8, 16.1.x before 16.1.6.1, 17.1.x before 17.1.3, or 17.5.x before 17.5.1.2) using tools like Shodan or Censys, filtering for HTTP/2-enabled endpoints.
2. Establish HTTP/2 connection: Open a standard HTTP/2 connection to the target BIG-IP virtual server or management interface that accepts HTTP/2 traffic.
3. Open multiple streams: Initiate multiple HTTP/2 streams on the single connection, approaching the server's SETTINGS_MAX_CONCURRENT_STREAMS limit.
4. Trigger server-side resets: Send malformed HTTP/2 control frames (e.g., frames violating flow control rules or containing invalid headers) that cause the server to respond with RST_STREAM frames, resetting the streams from the server side.
5. Exploit the accounting mismatch: Because the server-sent RST_STREAM frames cause the protocol to consider those streams closed (removing them from the concurrent stream counter), the attacker can immediately open new streams. The backend, however, continues processing the previously reset requests.
6. Sustain the attack: Continuously repeat steps 3–5 to force the server to process an unbounded number of concurrent HTTP/2 requests, exhausting CPU or memory resources and causing a denial-of-service condition (CERT/CC VU#767506, F5 Advisory).

• Network: Anomalously high volume of HTTP/2 RST_STREAM frames originating from a single client IP or small set of IPs; sustained high rate of new HTTP/2 stream openings on a single connection; unusual spikes in HTTP/2 traffic to BIG-IP virtual servers.
• System Performance: Sudden and sustained CPU or memory exhaustion on BIG-IP TMM (Traffic Management Microkernel) processes without a corresponding increase in legitimate traffic; degraded or failed health checks on BIG-IP pool members.
• Logs: BIG-IP LTM logs showing repeated connection resets or stream errors from the same source IP; TMM logs indicating resource exhaustion or stream limit violations; high error rates in /var/log/ltm related to HTTP/2 stream processing.
• Process: Abnormal TMM process resource consumption visible via tmsh show sys performance or top; BIG-IP SNMP traps or alerts for high CPU/memory thresholds being triggered.

F5 has released patched versions addressing CVE-2025-54500. Users should upgrade to the following fixed versions: BIG-IP 15.1.10.8, 16.1.6.1, 17.1.3, or 17.5.1.2 (as applicable to their branch). For BIG-IP Next Central Manager, version 20.3.0 is listed as affected — consult the F5 advisory for Next-generation product guidance. As interim workarounds, F5 recommends implementing network-level protections to filter malformed HTTP/2 control frames, monitoring HTTP/2 traffic for suspicious stream manipulation, and considering temporarily disabling HTTP/2 on affected virtual servers if immediate patching is not feasible. Prioritize patching for internet-facing BIG-IP systems and those handling critical application traffic (F5 Advisory).

The MadeYouReset vulnerability received significant media and research community attention upon its August 13, 2025 disclosure. The Hacker News, GBHackers, CyberSecurityNews, and SOCRadar all published coverage highlighting the attack's similarity to the 2023 "Rapid Reset" (CVE-2023-44487) and its potential for large-scale DDoS abuse (The Hacker News, SOCRadar). The vulnerability was discovered and reported by researchers Gal Bar Nahum, Anat Bremler-Barr, and Yaniv Harel of Tel Aviv University, who published supplemental materials at galbarnahum.com/made-you-reset (CERT/CC VU#767506). CERT/CC coordinated disclosure across a broad set of vendors, with many (including HAProxy, Go, Envoy, and Traefik) confirming they are not affected due to mitigations already in place from the Rapid Reset incident. SentinelOne included the vulnerability in its Week 33 threat landscape digest, and Black Kite featured it in multiple Focus Friday TPRM advisories.