GitHub Advisoryadvisory · Maven

GHSA-95h4-w6j8-2rp8 Undertow MadeYouReset HTTP/2 DDoS Vulnerability

HIGH Published 2025-09-02 Modified 2026-10-06 Official page ↗
Aliases
CVE-2025-9784
Ecosystem
Maven
Packages
io.undertow:undertow-core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-404, CWE-770
Reviewed
2025-09-02

Affected packages

• Maven io.undertow:undertow-core: < 2.2.38.Final → fixed in 2.2.38.Final • Maven io.undertow:undertow-core: >= 2.3.0.Alpha1, < 2.3.20.Final → fixed in 2.3.20.Final

Description

A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).

Related

Alias · CVE (1)

  • CVE-2025-9784 A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. vulnerability

Weakness · CWE (2)

  • CWE-404 Improper Resource Shutdown or Release weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References