# CVE-2025-9784: Red Hat Undertow denial of service via MadeYouReset attack

Source: https://junglewise.ai/threats/cve-2025-9784-red-hat-undertow-denial-of-service-via-madeyoureset-attack  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-09-02. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2025-9784 · Severity: high · CVSS 7.5 · Published 2025-09-02

A vulnerability in the Undertow web server allows remote attackers to overwhelm the system by sending specially crafted HTTP/2 requests. This 'MadeYouReset' attack bypasses standard security counters, potentially leading to a total service outage or significant performance degradation. Organizations using Undertow for web services or application hosting are at risk of denial-of-service attacks.

Technologies: [io.undertow:undertow-core (Maven)](https://junglewise.ai/threats/technologies/io-undertow-undertow-core). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2025-9784 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-9784 being exploited in the wild.

**How severe is CVE-2025-9784?** High severity, with a CVSS score of 7.5, published 2 September 2025.

**Which products and versions are affected?** io.undertow:undertow-core (Maven) ECOSYSTEM:introduced=0,fixed=2.2.38.Final; Red Hat Apache Camel for Spring Boot 4.14.2.

**Is there a fix for CVE-2025-9784?** Yes. io.undertow:undertow-core (Maven): upgrade to 2.2.38.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-9784 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-9784?** Check whether you run io.undertow:undertow-core (Maven) or Red Hat Apache Camel for Spring Boot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- io.undertow:undertow-core (Maven): upgrade to 2.2.38.Final or later

  ```sh
  # set io.undertow:undertow-core to 2.2.38.Final in your pom.xml or build.gradle
  ```


## Technical details

A resource exhaustion vulnerability exists in Undertow's HTTP/2 implementation, specifically regarding how it handles malformed client requests. An attacker can send a sequence of malformed requests that trigger server-side stream resets (RST_STREAM) without incrementing the internal abuse or flood counters. This 'MadeYouReset' attack allows a remote, unauthenticated attacker to induce excessive CPU and memory workload on the server, eventually leading to a denial-of-service (DoS) condition. The issue is rooted in improper resource shutdown and lack of throttling for these specific reset scenarios. Patches are available in versions 2.2.38.Final and 2.3.20.Final.

## Affected products

- Undertow undertow-core < 2.2.38.Final, >= 2.3.0.Alpha1, < 2.3.20.Final

## Identifiers

- CVE-2025-9784
- GHSA-95h4-w6j8-2rp8

## Timeline

- 2025-09-02: advisory: Initial publication of GHSA-95h4-w6j8-2rp8
- 2025-09-02: disclosed: NVD publication date
- 2026-06-30: other: Last updated date

## References

- [https://api.github.com/users/fawind](https://api.github.com/users/fawind)
- [https://github.com/fawind](https://github.com/fawind)
- [https://api.github.com/users/fawind/gists%7B/gist_id%7D](https://api.github.com/users/fawind/gists%7B/gist_id%7D)
- [https://api.github.com/users/fawind/repos](https://api.github.com/users/fawind/repos)
- [https://avatars.githubusercontent.com/u/7422050?v=4](https://avatars.githubusercontent.com/u/7422050?v=4)
- [https://api.github.com/users/fawind/events%7B/privacy%7D](https://api.github.com/users/fawind/events%7B/privacy%7D)

## Related threats

- [Red Hat Undertow resource exhaustion in HTTP request parsing](https://junglewise.ai/threats/cve-2026-3260-red-hat-undertow-resource-exhaustion-in-http-request-parsing)
- [Red Hat Undertow denial of service via OutOfMemoryError in getParameterNames](https://junglewise.ai/threats/cve-2024-4027-red-hat-undertow-denial-of-service-via-outofmemoryerror-in)
- [Red Hat Undertow improper Host header validation](https://junglewise.ai/threats/cve-2025-12543-red-hat-undertow-improper-host-header-validation)
- [Red Hat Undertow OutOfMemory denial of service in form parsing](https://junglewise.ai/threats/cve-2024-3884-red-hat-undertow-outofmemory-denial-of-service-in-form-parsing)
- [Withdrawn Advisory: undertow: information leakage via HTTP/2 request header reuse](https://junglewise.ai/threats/cve-2024-4109-withdrawn-advisory-undertow-information-leakage-via-http-2-request)