What MadeYouReset does
MadeYouReset (disclosed in 2025, CVE-2025-8671 and related) is the successor to HTTP/2 Rapid Reset. Instead of the client cancelling streams — which the post-2023 mitigations cap — the client provokes the server into sending RST_STREAM with a protocol-violating frame. A server-sent reset does not count against the client’s concurrent-stream budget, so the attacker keeps opening reset-me streams without bound while the server still pays the per-stream setup and teardown cost.
How ddos-simulation.com simulates it safely
ddos-simulation.com speaks genuine HTTP/2 to a single verified domain, opens fully-formed request streams, and sends the reset-provoking frame within the domain’s rate limits. The request is fixed and non-configurable, and the verified domain must serve HTTP/2.
Authorized targets onlyEvery run is bound to one verified domain you have proven you own. Ownership is checked over HTTPS before anything is scheduled, and running traffic against systems you do not own or are not clearly authorized to test may be unlawful. See the Acceptable Use Policy.
What the test exercises
- Whether your Rapid Reset mitigation also accounts for server-initiated resets
- Per-connection stream accounting under forced resets
- CPU cost of stream setup and teardown when the server resets
- Proxy, load-balancer, and origin behavior
- Recovery once the connection is closed
When to run an HTTP/2 MadeYouReset test
Run an HTTP/2 MadeYouReset test when you need to check whether server-initiated resets can slip past your rapid-reset mitigation.
- You mitigated CVE-2023-44487 with a client-reset cap and want to confirm server-sent resets don't bypass it (CVE-2025-8671 class).
- You run HTTP/2 origins or proxies and want evidence the concurrency accounting holds under provoked resets.
- You're validating a recent HTTP/2 patch against a subtler reset pattern than classic rapid reset.
How to run an HTTP/2 MadeYouReset test
- Verify your domain. Prove ownership over HTTPS — it is self-service and takes minutes.
- Add the
http2_made_you_reset command to a timeline in the portal and set the rate, duration, and any concurrency limit. - Set health thresholds. Choose the error-rate, latency, or status-code limits at which the test should abort itself.
- Run and watch. Bounded workers are provisioned minutes before start and torn down the moment the last task ends, while metrics stream live.
- Read the results. Review the recorded latency, status codes, and worker timeline to find where your service starts to bend.
Configure an HTTP/2 MadeYouReset test in the portal →
Reading the results
Resilient: Provoked resets are counted against the same limits, CPU stays bounded, and the server keeps servicing legitimate streams.
Under strain: Work keeps piling up despite the concurrency cap, CPU climbs, and the connection degrades — the mitigation is only counting client resets.
Availability & limits
MadeYouReset is priced per engagement — request a quote. Verify your domain before it runs.
Frequently asked questions
What is MadeYouReset?
A 2025 HTTP/2 denial-of-service (CVE-2025-8671 class) that revives Rapid Reset by making the server reset streams, sidestepping the concurrent-stream limit that mitigated CVE-2023-44487.
I patched Rapid Reset — am I safe?
Not necessarily. MadeYouReset specifically targets mitigations that only count client-initiated resets. This test shows whether server-initiated resets are also bounded.
Rehearse an HTTP/2 MadeYouReset test against infrastructure you own — bounded, monitored, and stopped the instant you have your answer.
Build a test plan