~ / search / GHSA-95h4-w6j8-2rp8

GHSA-95h4-w6j8-2rp8

Undertow MadeYouReset HTTP/2 DDoS Vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2025-9784

Packages

EcosystemPackageAffectedFixed in
Maven io.undertow:undertow-core < 2.2.38.Final 2.2.38.Final
Maven io.undertow:undertow-core >= 2.3.0.Alpha1, < 2.3.20.Final 2.3.20.Final

Details

As written in the advisory (Markdown source, shown as plain text).

A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).

References

External links from the advisory. They lead to third-party sites.