Undertow
CVE-2025-9784
HIGH
GHSA-95h4-w6j8-2rp8
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS score of 7.5 (High) reflects the network-accessible attack vector with low complexity and no authentication required, targeting availability exclusively. However, the EPSS score of 1.17% suggests relatively low observed exploitation in the wild currently, placing it in the 78th percentile. The attack requires sustained request patterns to achieve meaningful DoS impact, and modern infrastructure protections like rate limiting at load balancers or WAFs may mitigate severity. According to SSVC decision framework considerations, the vulnerability is automatable (malicious clients can script repeated malformed requests), has confirmed proof-of-concept availability via GitHub pull request #1778, and technical impact is limited to availability disruption without data confidentiality or integrity compromise. This represents a real but manageable priority: organizations running public-facing JBoss/Undertow services should prioritize patching within standard maintenance windows, while internet-exposed instances warrant more urgent attention. The vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation campaigns, but the straightforward exploitation path and widespread deployment of affected Red Hat products elevate risk for high-availability environments. |
| Exploit ScenarioDerived | A remote attacker crafts a series of malformed HTTP/2 requests designed to trigger server-side stream resets in Undertow without properly incrementing the abuse counter. By scripting these requests from multiple source IPs or through a botnet, the attacker forces the server to repeatedly allocate resources for new streams, process the malformed data, abort the streams, and perform cleanup operations. Since the abuse detection mechanisms fail to track these server-initiated resets, the attack continues unthrottled, consuming CPU cycles and memory until the server becomes unresponsive to legitimate client requests, achieving denial of service. A proof-of-concept implementation is available through analysis of the patch in GitHub PR #1778. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 18, 2026
Undertow, a Java web server used across Red Hat's JBoss Enterprise Application Platform, Fuse, and other middleware products, contains a vulnerability that allows attackers to trigger server-side HTTP/2 stream resets without incrementing abuse counters. This 'MadeYouReset' attack enables remote unauthenticated attackers to cause denial of service by repeatedly forcing the server to abort streams and perform unnecessary cleanup work. With an EPSS score of 1.17% (78th percentile), exploitation probability is moderate but rising, and patches have been released across multiple Red Hat product lines as of early 2025.
RemediationAI
Upgrade to Undertow version 2.2.38.Final or later, which implements proper abuse counters for server-initiated stream resets as documented in GitHub pull request https://github.com/undertow-io/undertow/pull/1778. Red Hat customers should apply the relevant security updates through their product-specific advisories: RHSA-2026:0383, RHSA-2026:0384, RHSA-2026:0386 for JBoss EAP; RHSA-2026:3889, RHSA-2026:3891, RHSA-2026:3892 for additional middleware components; and RHSA-2026:4915, RHSA-2026:4916, RHSA-2026:4917, RHSA-2026:4924 for platform-specific patches, all accessible via https://access.redhat.com/errata/. Until patching is completed, implement network-level rate limiting on HTTP/2 connections, deploy web application firewalls configured to detect abnormal stream reset patterns, and consider temporarily disabling HTTP/2 in favor of HTTP/1.1 for critical services if DoS attacks are observed. Monitor server logs for excessive RST_STREAM activity and configure connection limits per client IP address.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in maven
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Undertow is a lightweight, high-performance Java web server that provides both blocking and non-blocking APIs, commonly embedded in Red Hat JBoss Enterprise Application Platform versions 7.0.0 and 8.0.0, Red Hat Fuse 7.0.0, Single Sign-On 7.0, and other middleware products. The vulnerability stems from CWE-770 (Allocation of Resources Without Limits or Throttling), where the HTTP/2 implementation fails to properly track and limit malformed client requests that cause server-initiated stream resets. Unlike legitimate RST_STREAM frames from clients, these server-side resets triggered by crafted malformed requests bypass abuse detection mechanisms, allowing attackers to exhaust server resources through repeated stream abort cycles without being rate-limited or blocked.
Know when Undertow gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).
Executive ViewAI
A vulnerability in Undertow (used in Red Hat JBoss and middleware products) allows unauthenticated attackers to trigger denial-of-service attacks by exploiting HTTP/2 stream handling without detection. Organizations running affected Red Hat middleware are at risk of service disruption; however, no patch is currently available, requiring immediate mitigation planning.
Without vendor patch available: (1) Deploy WAF/reverse proxy rules to detect and rate-limit repeated HTTP/2 stream resets from single sources; (2) Configure network-level ingress filtering to limit concurrent HTTP/2 connections per IP; (3) Disable HTTP/2 protocol on Undertow and fall back to HTTP/1.1 if operationally tolerable; (4) Implement connection timeout and stream reset per-session quotas at load balancer; (5) Enable detailed HTTP/2 stream logging to identify attack patterns; (6) Segment affected systems behind API gateways with abuse detection; (7) Monitor actively for patch releases from Red Hat and plan immediate deployment upon availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x before 1.1.0.CR5, and 1.2.x before 1.2.0.
A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in U
A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. Rated critical severi
A vulnerability was found in Undertow web server before 2.0.21. Rated critical severity (CVSS 9.8), this vulnerability i
Undertow HTTP server (used in WildFly, JBoss EAP) fails to validate Host headers, enabling cache poisoning, internal net
A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x
A flaw was found in Undertow. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authenticat
A flaw was found in undertow. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authenticat
A flaw was found in undertow. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authenticat
A flaw was found in Undertow. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authenticat
A flaw was found in Undertow. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authenticat
When a POST request comes through AJP and the request exceeds the max-post-size limit (maxEntitySize), Undertow's AjpSer
Exploit-DB