CVE-2025-9784 Undertow: undertow madeyoureset http/2 ddos vulnerability
A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).
Problem types: cwe_id: CWE-770
description: Allocation of Resources Without Limits or Throttling
Affected products: default_status: unaffected
vendor: Red Hat
product: Red Hat build of Apache Camel 4.14.2 for Spring Boot 3.5.8
cpes: cpe:/a:redhat:apache_camel_spring_boot:4.14
default_status: unaffected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:7.4
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
cpes: cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
cpes: cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: unaffected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.1
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
default_status: unaffected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Apache Camel - HawtIO 4
cpes: cpe:/a:redhat:apache_camel_hawtio:4
default_status: unaffected
vendor: Red Hat
product: Red Hat Data Grid 8
cpes: cpe:/a:redhat:jboss_data_grid:8
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 10
cpes: cpe:/o:redhat:enterprise_linux:10
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8
default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/o:redhat:enterprise_linux:9
default_status: unaffected
vendor: Red Hat
product: Red Hat Fuse 7
cpes: cpe:/a:redhat:jboss_fuse:7
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 7
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:7
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8
default_status: unaffected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform 8
cpes: cpe:/a:redhat:jboss_enterprise_application_platform:8
default_status: unaffected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform Expansion Pack
cpes: cpe:/a:redhat:jbosseapxp
default_status: affected
vendor: Red Hat
product: Red Hat JBoss Enterprise Application Platform Expansion Pack
cpes: cpe:/a:redhat:jbosseapxp
default_status: unaffected
vendor: Red Hat
product: Red Hat Process Automation 7
cpes: cpe:/a:redhat:jboss_enterprise_bpms_platform:7
default_status: affected
vendor: Red Hat
product: Red Hat Single Sign-On 7
cpes: cpe:/a:redhat:red_hat_single_sign_on:7
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-09-02T13:37:59.772Z