CVEvulnerability

CVE-2025-9784

7.5 HIGH Published 2025-09-02 Modified 2026-10-14 Official page ↗
Status
Modified
Published
2025-09-02
Last modified
2026-10-14
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-404, CWE-770

Description

A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).

Affected configurations

• redhat build of apache camel for spring boot • redhat fuse 7.0.0 • redhat jboss enterprise application platform 7.0.0 • redhat jboss enterprise application platform 8.0.0 • redhat jboss enterprise application platform expansion pack • redhat process automation 7.0 • redhat single sign-on 7.0 • redhat undertow • redhat enterprise linux 8.0 • redhat enterprise linux 9.0

Related

Weakness · CWE (2)

  • CWE-404 Improper Resource Shutdown or Release weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References