The vulnerability identified as CVE-2025-5115 affects HTTP/2 implementations in Jetty components and Netty's HTTP/2 codec. It arises from an implementation weakness where malformed client requests cause server-side stream resets without triggering abuse counters, allowing attackers to bypass throttling and resource limits. This leads to excessive CPU and memory consumption, resulting in denial of service. The issue is referred to as the "MadeYouReset" attack. Red Hat has issued a security advisory and released a patch update for the Red Hat Offline Knowledge Portal container image that mitigates this vulnerability. However, no comprehensive mitigation is currently available for all affected products. The vulnerability is rated as important/high severity due to ease of exploitation and impact on service availability.

Exploitation of this vulnerability can cause denial of service by exhausting server CPU and memory resources through repeated server-side stream resets triggered by malformed HTTP/2 requests. This can degrade or disrupt service availability for legitimate users. The vulnerability requires no authentication and can be exploited remotely over the network. No confidentiality or integrity impacts are reported. There are no known exploits in the wild at this time.

Red Hat has released an updated container image for the Red Hat Offline Knowledge Portal that includes mitigations for CVE-2025-5115. Users should update to this version by pulling the updated container image from the Red Hat container registry using a valid subscription. Currently, no other mitigation meets Red Hat's standards for usability and stability. Users should monitor Red Hat advisories for future updates and consider applying the available update to affected products where applicable.