CyberSecBulletin
CVE-2025-8671NVD status: Deferred

Enterprise Module for Development Tools: Improper Resource Shutdown or Release

Published Updated By the CyberSecBulletin desk

CVE-2025-8671 is a high-severity improper resource shutdown or release vulnerability in Enterprise Module for Development Tools from SUSE Linux, with a CVSS 3.1 base score of 7.5 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists version 15-SP5 as the first without the flaw, so updating Enterprise Module for Development Tools to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 3.44% chance of exploitation within 30 days, higher than 89% of scored CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Enterprise Module for Development Tools to 15-SP5 or a later version.
  2. Update Enterprise High Performance Computing (HPC) to 15 SP5 or a later version.
  3. Update Enterprise Desktop to 15 SP7 or a later version.
  4. Read the advisory on github.com for workarounds and exact fixed builds.
  5. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
SUSE LinuxEnterprise Module for Development Tools15 SP2 up to, but not including, 15-SP515-SP5
SUSE LinuxEnterprise High Performance Computing (HPC)15 up to, but not including, 15 SP515 SP5
Varnish SoftwareVarnish Enterprise6.0.x through 6.0.14r4Not stated
Varnish SoftwareVarnish Cache6.0LTS through 6.014; 5.x through 7.71Not stated
FastlyH20579ecfaNot stated
Wind RiverLinuxLTS22 through TLS25Not stated
SUSE LinuxEnterprise Desktop15 SP6 up to, but not including, 15 SP715 SP7
SUSE LinuxEnterprise High Performance Computing15 SP3 up to, but not including, 15 SP715 SP7
SUSE LinuxEnterprise Module for Dev Tools15 SP3 up to, but not including, 15 SP715 SP7
SUSE LinuxEnterprise Module for Package Hub15 SP5 up to, but not including, 15 SP715 SP7
SUSE LinuxEnterprise Server12 SP5 up to, but not including, 15 SP715 SP7
SUSE LinuxEnterprise Server for SAP Applications15 SP6 up to, but not including, 15 SP715 SP7
SUSE LinuxSUSE Manager Server4.3Not stated
SUSE LinuxSUSE Manager Server LTS4.3Not stated
SUSE LinuxSUSE Manager Proxy4.3Not stated
SUSE LinuxSUSE Manager Retail Branch Server4.3Not stated
SUSE LinuxopenSUSE Leap15.6Not stated

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
NoneNo data is disclosed.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Scored by CISA (ADP).

Official description

A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Resource Shutdown or Release

The product does not release or incorrectly releases a resource before it is made available for re-use.

How developers prevent this class of flaw

  • Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, languages such as Java, Ruby, and Lisp perform automatic garbage collection that releases memory for objects that have been deallocated.
  • It is good practice to be responsible for freeing all resources you allocate and to be consistent with how and where you free memory in a function. If you allocate memory that you intend to free upon completion of the function, you must be sure to free the memory at all exit points for that function including error conditions.
  • Memory should be allocated/freed using matching functions such as malloc/free, new/delete, and new[]/delete[].

More Improper Resource Shutdown or Release vulnerabilities (CWE-404)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: poc, automatable: yes, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Improper Resource Shutdown or Release vulnerabilities

Spotted an error? Tell us.