CVE-2025-9784

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-9784
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-9784.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-9784
Aliases
Downstream
CGA (4)
CLSA (3)
DEBIAN (1)
RHSA (12)
UBUNTU (1)
Published
2025-09-02T13:37:59Z
Modified
2026-10-22T10:31:58Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Undertow: undertow madeyoureset http/2 ddos vulnerability
Details

A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).

Database specific 
{
    "cna_assigner": "redhat",
    "cwe_ids": [
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/9xxx/CVE-2025-9784.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "fixed": "0:1.4.18-21.SP19_redhat_00001.1.ep7.el7"
                        },
                        {
                            "fixed": "0:2.0.41-8.SP9_redhat_00001.1.el7eap"
                        },
                        {
                            "fixed": "2.2.39.Final-redhat-00001"
                        },
                        {
                            "fixed": "0:2.2.39-1.Final_redhat_00001.1.el7eap"
                        },
                        {
                            "fixed": "0:7.4.24-4.GA_redhat_00002.1.el7eap"
                        },
                        {
                            "fixed": "0:2.2.39-1.Final_redhat_00001.1.el8eap"
                        },
                        {
                            "fixed": "0:7.4.24-4.GA_redhat_00002.1.el8eap"
                        },
                        {
                            "fixed": "0:2.2.39-1.Final_redhat_00001.1.el9eap"
                        },
                        {
                            "fixed": "0:7.4.24-4.GA_redhat_00002.1.el9eap"
                        },
                        {
                            "fixed": "0:1.83.0-1.redhat_00001.1.el8eap"
                        },
                        {
                            "fixed": "0:33.0.0-2.jre_redhat_00003.1.el8eap"
                        },
                        {
                            "fixed": "0:4.0.6-1.redhat_00001.1.el8eap"
                        },
                        {
                            "fixed": "0:1.0.0-3.redhat_00009.1.el8eap"
                        },
                        {
                            "fixed": "0:2.0.2-1.Final_redhat_00001.1.el8eap"
                        },
                        {
                            "fixed": "0:2.3.23-1.SP3_redhat_00001.1.el8eap"
                        },
                        {
                            "fixed": "0:1.83.0-1.redhat_00001.1.el9eap"
                        },
                        {
                            "fixed": "0:33.0.0-2.jre_redhat_00003.1.el9eap"
                        },
                        {
                            "fixed": "0:4.0.6-1.redhat_00001.1.el9eap"
                        },
                        {
                            "fixed": "0:1.0.0-3.redhat_00009.1.el9eap"
                        },
                        {
                            "fixed": "0:2.0.2-1.Final_redhat_00001.1.el9eap"
                        },
                        {
                            "fixed": "0:2.3.23-1.SP3_redhat_00001.1.el9eap"
                        },
                        {
                            "fixed": "2.3.20.SP4-redhat-00001"
                        },
                        {
                            "fixed": "0:4.0.10-1.redhat_00001.1.el8eap"
                        },
                        {
                            "fixed": "0:1.82.0-1.redhat_00001.1.el8eap"
                        },
                        {
                            "fixed": "0:801.3.0-1.GA_redhat_00001.1.el8eap"
                        },
                        {
                            "fixed": "0:1.0.1-3.redhat_00003.1.el8eap"
                        },
                        {
                            "fixed": "0:6.6.36-1.Final_redhat_00001.1.el8eap"
                        },
                        {
                            "fixed": "0:4.0.2-1.Final_redhat_00001.1.el8eap"
                        },
                        {
                            "fixed": "0:2.5.0-1.redhat_00001.1.el8eap"
                        },
                        {
                            "fixed": "0:2.3.20-2.SP4_redhat_00001.1.el8eap"
                        },
                        {
                            "fixed": "0:8.1.3-4.GA_redhat_00006.1.el8eap"
                        },
                        {
                            "fixed": "0:5.0.12-1.Final_redhat_00001.1.el8eap"
                        },
                        {
                            "fixed": "0:2.6.6-1.Final_redhat_00001.1.el8eap"
                        },
                        {
                            "fixed": "0:8.1.1-4.GA_redhat_00007.1.el8eap"
                        },
                        {
                            "fixed": "0:4.0.10-1.redhat_00001.1.el9eap"
                        },
                        {
                            "fixed": "0:1.82.0-1.redhat_00001.1.el9eap"
                        },
                        {
                            "fixed": "0:801.3.0-1.GA_redhat_00001.1.el9eap"
                        },
                        {
                            "fixed": "0:1.0.1-3.redhat_00003.1.el9eap"
                        },
                        {
                            "fixed": "0:6.6.36-1.Final_redhat_00001.1.el9eap"
                        },
                        {
                            "fixed": "0:4.0.2-1.Final_redhat_00001.1.el9eap"
                        },
                        {
                            "fixed": "0:2.5.0-1.redhat_00001.1.el9eap"
                        },
                        {
                            "fixed": "0:2.3.20-2.SP4_redhat_00001.1.el9eap"
                        },
                        {
                            "fixed": "0:8.1.3-4.GA_redhat_00006.1.el9eap"
                        },
                        {
                            "fixed": "0:5.0.12-1.Final_redhat_00001.1.el9eap"
                        },
                        {
                            "fixed": "0:2.6.6-1.Final_redhat_00001.1.el9eap"
                        },
                        {
                            "fixed": "0:8.1.1-4.GA_redhat_00007.1.el9eap"
                        },
                        {
                            "fixed": "0:18.0.20-1.redhat_00001.1.el7sso"
                        },
                        {
                            "fixed": "0:18.0.20-1.redhat_00001.1.el8sso"
                        },
                        {
                            "fixed": "0:18.0.20-1.redhat_00001.1.el9sso"
                        },
                        {
                            "fixed": "7.6-85"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "InverseAffectedRanges"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/undertow-io/undertow

Affected ranges

Type
GIT
Repo
https://github.com/undertow-io/undertow
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6267eb1328fa08d996cbf3643b91253310fc9dd6
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "2.2.38.Final"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "original_tag": "2.2.38.Final",
            "range": [
                {
                    "fixed": "6267eb1328fa08d996cbf3643b91253310fc9dd6"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

1.*
1.0.0.Alpha1
1.0.0.Alpha10
1.0.0.Alpha11
1.0.0.Alpha12
1.0.0.Alpha13
1.0.0.Alpha14
1.0.0.Alpha15
1.0.0.Alpha16
1.0.0.Alpha17
1.0.0.Alpha18
1.0.0.Alpha19
1.0.0.Alpha2
1.0.0.Alpha20
1.0.0.Alpha21
1.0.0.Alpha22
1.0.0.Alpha3
1.0.0.Alpha4
1.0.0.Alpha5
1.0.0.Alpha6
1.0.0.Alpha7
1.0.0.Alpha8
1.0.0.Alpha9
1.0.0.Beta1
1.0.0.Beta10
1.0.0.Beta11
1.0.0.Beta12
1.0.0.Beta13
1.0.0.Beta14
1.0.0.Beta15
1.0.0.Beta16
1.0.0.Beta17
1.0.0.Beta18
1.0.0.Beta19
1.0.0.Beta2
1.0.0.Beta20
1.0.0.Beta21
1.0.0.Beta22
1.0.0.Beta23
1.0.0.Beta24
1.0.0.Beta25
1.0.0.Beta26
1.0.0.Beta27
1.0.0.Beta28
1.0.0.Beta29
1.0.0.Beta3
1.0.0.Beta30
1.0.0.Beta31
1.0.0.Beta32
1.0.0.Beta33
1.0.0.Beta4
1.0.0.Beta5
1.0.0.Beta6
1.0.0.Beta7
1.0.0.Beta8
1.0.0.Beta9
1.0.0.CR1
1.0.0.CR2
1.0.0.CR3
1.0.0.CR4
1.0.0.Final
1.0.1.Final
1.0.2.Final
1.0.3.Final
1.1.0.Beta1
1.1.0.Beta2
1.1.0.Beta3
1.1.0.Beta4
1.1.0.Beta5
1.1.0.Beta6
1.1.0.Beta7
1.1.0.Beta8
1.2.0.Beta1
1.2.0.Beta10
1.2.0.Beta2
1.2.0.Beta3
1.2.0.Beta4
1.2.0.Beta5
1.2.0.Beta6
1.2.0.Beta7
1.2.0.Beta8
1.2.0.Beta9
1.2.0.CR1
1.2.0.Final
1.2.1.Final
1.2.2.Final
1.2.3.Final
1.2.4.Final
1.3.0.Beta1
1.3.0.Beta10
1.3.0.Beta11
1.3.0.Beta12
1.3.0.Beta13
1.3.0.Beta2
1.3.0.Beta3
1.3.0.Beta4
1.3.0.Beta5
1.3.0.Beta6
1.3.0.Beta7
1.3.0.Beta8
1.3.0.Beta9
1.3.0.CR1
1.3.0.CR2
1.3.0.CR3
1.3.0.Final
1.3.1.Final
1.3.2.Final
1.3.3.Final
2.*
2.0.0.Alpha1
2.0.0.Beta1
2.0.0.Final
2.0.1.Final
2.0.10.Final
2.0.11.Final
2.0.12.Final
2.0.13.Final
2.0.14.Final
2.0.15.Final
2.0.16.Final
2.0.17.Final
2.0.2.Final
2.0.20.Final
2.0.21.Final
2.0.22.Final
2.0.23.Final
2.0.24.Final
2.0.25.Final
2.0.26.Final
2.0.27.Final
2.0.28.Final
2.0.29.Final
2.0.3.Final
2.0.4.Final
2.0.5.Final
2.0.6.Final
2.0.7.Final
2.0.8.Final
2.0.9.Final
2.1.0.Final
2.1.1.Final
2.1.2.Final
2.1.3.Final
2.1.4.Final
2.2.0.Final
2.2.1.Final
2.2.10.Final
2.2.11.Final
2.2.12.Final
2.2.13.Final
2.2.14.Final
2.2.15.Final
2.2.16.Final
2.2.17.Final
2.2.18.Final
2.2.19.Final
2.2.2.Final
2.2.20.Final
2.2.21.Final
2.2.22.Final
2.2.23.Final
2.2.24.Final
2.2.25.Final
2.2.26.Final
2.2.27.Final
2.2.28.Final
2.2.3.Final
2.2.30.Final
2.2.31.Final
2.2.32.Final
2.2.33.Final
2.2.34.Final
2.2.35.Final
2.2.36.Final
2.2.37.Final
2.2.4.Final
2.2.5.Final
2.2.6.Final
2.2.7.Final
2.2.8.Final
2.2.9.Final

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-9784.json"