ddos-sim.com All simulations Build a test plan

Layer 7 · Application · http2_made_you_reset

HTTP/2 MadeYouReset test

The http2_made_you_reset simulation opens HTTP/2 streams and provokes the server into resetting them — so they never count against the concurrency cap that mitigates plain Rapid Reset — against a domain you own.

Layer L7 Protocol HTTP/2 Command http2_made_you_reset Access Quote on request

What MadeYouReset does

MadeYouReset (disclosed in 2025, CVE-2025-8671 and related) is the successor to HTTP/2 Rapid Reset. Instead of the client cancelling streams — which the post-2023 mitigations cap — the client provokes the server into sending RST_STREAM with a protocol-violating frame. A server-sent reset does not count against the client’s concurrent-stream budget, so the attacker keeps opening reset-me streams without bound while the server still pays the per-stream setup and teardown cost.

How ddos-sim.com simulates it safely

ddos-sim.com speaks genuine HTTP/2 to a single verified domain, opens fully-formed request streams, and sends the reset-provoking frame within the domain’s rate limits. The request is fixed and non-configurable, and the verified domain must serve HTTP/2.

Authorized targets only

Every run is bound to one verified domain you have proven you own. Ownership is checked over HTTPS before anything is scheduled, and running traffic against systems you do not own or are not clearly authorized to test may be unlawful. See the Acceptable Use Policy.

What the test exercises

  • Whether your Rapid Reset mitigation also accounts for server-initiated resets
  • Per-connection stream accounting under forced resets
  • CPU cost of stream setup and teardown when the server resets
  • Proxy, load-balancer, and origin behavior
  • Recovery once the connection is closed

How to run an HTTP/2 MadeYouReset test

  1. Verify your domain. Prove ownership over HTTPS — it is self-service and takes minutes.
  2. Add the http2_made_you_reset command to a timeline in the portal and set the rate, duration, and any concurrency limit.
  3. Set health thresholds. Choose the error-rate, latency, or status-code limits at which the test should abort itself.
  4. Run and watch. Bounded workers are provisioned minutes before start and torn down the moment the last task ends, while metrics stream live.
  5. Read the results. Review the recorded latency, status codes, and worker timeline to find where your service starts to bend.

Configure an HTTP/2 MadeYouReset test in the portal →

Availability & limits

MadeYouReset is priced per engagement — request a quote. Verify your domain before it runs.

Frequently asked questions

What is MadeYouReset?

A 2025 HTTP/2 denial-of-service (CVE-2025-8671 class) that revives Rapid Reset by making the server reset streams, sidestepping the concurrent-stream limit that mitigated CVE-2023-44487.

I patched Rapid Reset — am I safe?

Not necessarily. MadeYouReset specifically targets mitigations that only count client-initiated resets. This test shows whether server-initiated resets are also bounded.

Rehearse an HTTP/2 MadeYouReset test against infrastructure you own — bounded, monitored, and stopped the instant you have your answer.

Build a test plan
← All DDoS simulations