CVE-2025-9784: Undertow: undertow madeyoureset http/2 ddos vulnerability
Vulnerability summary
CVE-2025-9784 is a high (CVSS 7.5) vulnerability in redhat build_of_apache_camel_for_spring_boot. EPSS estimates a 2.33% chance of exploitation in the next 30 days, higher than 83.5% of scored vulnerabilities.
Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 2% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 12 · Related 1Timeline
- 02-09-2025PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).
CVSS metrics
7 scores · 7 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · MavenEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
2.33%
Chance of exploitation in the next 30 days
Percentile
84%
Versus all other CVEs
30-day change
No change 0.00 pp
From 2.33% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
- CWE-404Improper Resource Shutdown or ReleaseThe product does not release or incorrectly releases a resource before it is made available for re-use.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat8 products
- build_of_apache_camel_for_spring_bootna
- enterprise_linux8.0 | 9.0
- fuse7.0.0
- jboss_enterprise_application_platform7.0.0 | 8.0.0
- jboss_enterprise_application_platform_expansion_packna
Chainguard2 products
- wildfly-openjdk-17< 38.0.0-r0
- wildfly-openjdk-21< 38.0.0-r0
Ubuntu2 products
- resteasyAll versions (No fix recorded)
- undertowAll versions (No fix recorded)
Wolfi2 products
- wildfly-openjdk-17< 38.0.0-r0
- wildfly-openjdk-21< 38.0.0-r0
Debian1 product
- undertow< 2.3.20-1
Io.undertow1 product
- undertow-core< 2.2.38.Final | ≥ 2.3.0.Alpha1, < 2.3.20.Final
6 vendors · 16 products
References
38 linksShow all 38 references
- access.redhat.com/security/cve/CVE-2025-9784VDB EntryX Refsource REDHATREPORTAdvisoryWEBVendor Advisory
