CVE-2025-9784: Undertow: undertow madeyoureset http/2 ddos vulnerability

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-09-02 · updated 2026-10-14
Weakness: CWE-770

Description

A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).

Affected products

RedHat Build Of Apache Camel For Spring Boot: all versions
Red Hat Enterprise Linux: 8.0, 9.0
Red Hat Fuse: 7.0.0
Red Hat JBoss EAP: 7.0.0, 8.0.0
RedHat Jboss Enterprise Application Platform Expansion Pack: all versions
RedHat Process Automation: 7.0
Red Hat Single Sign-On: 7.0
Red Hat undertow: all versions

References

Get alerted when CVE-2025-9784 or the next vulnerability affects your stack