CVE-2025-9784 – This vulnerability in Undertow allows malicious... (How to Fix)

Q: What is the severity of CVE-2025-9784?

CVE-2025-9784 has a CVSS score of 7.5 (HIGH). This vulnerability in Undertow allows malicious clients to send malformed requests that trigger server-side stream resets without incrementing abuse counters. This 'MadeYouReset' attack enables denial of service by forcing the server to repeatedly abort streams, consuming excessive resources. Any system running vulnerable versions of Undertow is affected.

📋 TL;DR

This vulnerability in Undertow allows malicious clients to send malformed requests that trigger server-side stream resets without incrementing abuse counters. This 'MadeYouReset' attack enables denial of service by forcing the server to repeatedly abort streams, consuming excessive resources. Any system running vulnerable versions of Undertow is affected.

💻 Affected Systems

Products:

Undertow

Versions: Specific versions not detailed in provided references; check Red Hat advisories for exact ranges

Operating Systems: Linux (Red Hat Enterprise Linux variants)

Default Config Vulnerable: ⚠️ Yes

Notes: Affects Undertow implementations in default configurations; exact version ranges should be verified via Red Hat advisories.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete service unavailability due to resource exhaustion, potentially affecting all services running on the vulnerable Undertow instance.

🟠

Likely Case

Degraded performance and intermittent service disruptions as the server struggles with repeated stream resets.

🟢

If Mitigated

Minimal impact with proper rate limiting, monitoring, and updated versions in place.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires sending malformed HTTP/2 requests; no authentication needed.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Check specific Red Hat advisories (RHSA-2025:23143, RHSA-2026:0383, etc.) for patched versions

Vendor Advisory: https://access.redhat.com/security/cve/CVE-2025-9784

Restart Required: Yes

Instructions:

1. Identify affected Undertow version. 2. Apply relevant Red Hat patch via yum update. 3. Restart Undertow service. 4. Verify patch application.

🔧 Temporary Workarounds

Rate Limiting

all

Implement request rate limiting to reduce impact of repeated malicious requests.

# Configure via web server or application firewall rules

Connection Limits

all

Limit concurrent connections per client to mitigate resource exhaustion.

# Set in Undertow configuration or upstream load balancer

🧯 If You Can't Patch

Implement strict network filtering to limit access to Undertow services.
Deploy Web Application Firewall (WAF) with DoS protection rules.

🔍 How to Verify

Check if Vulnerable:

Check Undertow version against Red Hat advisories; run 'rpm -qa | grep undertow' on RHEL systems.

Check Version:

rpm -qa | grep undertow

Verify Fix Applied:

Verify updated package version matches patched version in Red Hat advisories.

📡 Detection & Monitoring

Log Indicators:

Unusual frequency of stream reset errors
Abnormally high request rates from single IPs

Network Indicators:

Spike in malformed HTTP/2 requests
Increased server response times

SIEM Query:

source="undertow.log" AND ("stream reset" OR "abort") | stats count by src_ip

📊 Metadata

CVE ID: CVE-2025-9784

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-770

EPSS Score: 0.7% exploit probability (71.4th percentile)

Published: September 2, 2025

Last Updated: March 5, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-9784, you might also want to check these: