Back to Database
Status published
High
CVE-2025-9784
Undertow: undertow madeyoureset http/2 ddos vulnerability
Vulnerability Description
A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-9784
Credits & Attribution
No credits recorded in the NVD database.
References
- https://access.redhat.com/errata/RHSA-2025:23143
- https://access.redhat.com/errata/RHSA-2026:0383
- https://access.redhat.com/errata/RHSA-2026:0384
- https://access.redhat.com/errata/RHSA-2026:0386
- https://access.redhat.com/errata/RHSA-2026:33371
- https://access.redhat.com/errata/RHSA-2026:33372
- https://access.redhat.com/errata/RHSA-2026:3889
- https://access.redhat.com/errata/RHSA-2026:3891
- https://access.redhat.com/errata/RHSA-2026:3892
- https://access.redhat.com/errata/RHSA-2026:4915
- https://access.redhat.com/errata/RHSA-2026:4916
- https://access.redhat.com/errata/RHSA-2026:4917
- https://access.redhat.com/errata/RHSA-2026:4924
- https://access.redhat.com/security/cve/CVE-2025-9784
- https://bugzilla.redhat.com/show_bug.cgi?id=2392306
- https://github.com/undertow-io/undertow/pull/1778
- https://github.com/undertow-io/undertow/releases/tag/2.2.38.Final
- https://issues.redhat.com/browse/UNDERTOW-2598
- https://kb.cert.org/vuls/id/767506
More from Unknown
View All →CVE-2025-9978
Jeg Elementor Kit < 2.7.0 - Author+ Stored XSS
Unknown
0
CVE-2025-9959
Sandbox escape in smolagents Local Python execution environment via dunder attributes
High
7.6
CVE-2025-9900
Libtiff: libtiff write-what-where
High
8.8
CVE-2025-9710
Responsive Lightbox & Gallery < 2.5.3 - Unauthenticated Stored-XSS via Comments
Unknown
0
CVE-2025-9703
Ultimate Addons for Elementor Lite < 2.5.0 - Author+ Stored XSS
Unknown
0
Affected Vendor
Unknown
View all reports →Affected Software
Red Hat build of Apache Camel 4.14.2 for Spring Boot 3.5.8, Red Hat JBoss Enterprise Application Platform, Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7, Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7, Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7, Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8, Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9, Red Hat JBoss Enterprise Application Platform 8.0, Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8, Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9, Red Hat JBoss Enterprise Application Platform 8.1, Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8, Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9, Red Hat build of Apache Camel - HawtIO 4, Red Hat Data Grid 8, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat Process Automation 7, Red Hat Single Sign-On 7
Vulnerable Versions:
0, 2.2.39.Final-redhat-00001, 0:1.4.18-21.SP19_redhat_00001.1.ep7.el7, 0:2.0.41-8.SP9_redhat_00001.1.el7eap, 0:2.2.39-1.Final_redhat_00001.1.el7eap, 0:7.4.24-4.GA_redhat_00002.1.el7eap, 0:2.2.39-1.Final_redhat_00001.1.el8eap, 0:7.4.24-4.GA_redhat_00002.1.el8eap, 0:2.2.39-1.Final_redhat_00001.1.el9eap, 0:7.4.24-4.GA_redhat_00002.1.el9eap, 0:1.83.0-1.redhat_00001.1.el8eap, 0:33.0.0-2.jre_redhat_00003.1.el8eap, 0:4.0.6-1.redhat_00001.1.el8eap, 0:1.0.0-3.redhat_00009.1.el8eap, 0:2.0.2-1.Final_redhat_00001.1.el8eap, 0:2.3.23-1.SP3_redhat_00001.1.el8eap, 0:1.83.0-1.redhat_00001.1.el9eap, 0:33.0.0-2.jre_redhat_00003.1.el9eap, 0:4.0.6-1.redhat_00001.1.el9eap, 0:1.0.0-3.redhat_00009.1.el9eap, 0:2.0.2-1.Final_redhat_00001.1.el9eap, 0:2.3.23-1.SP3_redhat_00001.1.el9eap, 0:4.0.10-1.redhat_00001.1.el8eap, 0:1.82.0-1.redhat_00001.1.el8eap, 0:801.3.0-1.GA_redhat_00001.1.el8eap, 0:1.0.1-3.redhat_00003.1.el8eap, 0:6.6.36-1.Final_redhat_00001.1.el8eap, 0:4.0.2-1.Final_redhat_00001.1.el8eap, 0:2.5.0-1.redhat_00001.1.el8eap, 0:2.3.20-2.SP4_redhat_00001.1.el8eap, 0:8.1.3-4.GA_redhat_00006.1.el8eap, 0:5.0.12-1.Final_redhat_00001.1.el8eap, 0:2.6.6-1.Final_redhat_00001.1.el8eap, 0:8.1.1-4.GA_redhat_00007.1.el8eap, 0:4.0.10-1.redhat_00001.1.el9eap, 0:1.82.0-1.redhat_00001.1.el9eap, 0:801.3.0-1.GA_redhat_00001.1.el9eap, 0:1.0.1-3.redhat_00003.1.el9eap, 0:6.6.36-1.Final_redhat_00001.1.el9eap, 0:4.0.2-1.Final_redhat_00001.1.el9eap, 0:2.5.0-1.redhat_00001.1.el9eap, 0:2.3.20-2.SP4_redhat_00001.1.el9eap, 0:8.1.3-4.GA_redhat_00006.1.el9eap, 0:5.0.12-1.Final_redhat_00001.1.el9eap, 0:2.6.6-1.Final_redhat_00001.1.el9eap, 0:8.1.1-4.GA_redhat_00007.1.el9eap
Timeline
Official Publish:
September 2nd, 2025
Last Modified:
June 30th, 2026
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H