Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2025-9784— Undertow: undertow madeyoureset http/2 ddos vulnerability

CVSS 7.5 · High EPSS 1.70% · P82

I. Basic Information for CVE-2025-9784

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Undertow: undertow madeyoureset http/2 ddos vulnerability
Source: NVD (National Vulnerability Database)
Vulnerability Description
A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
不加限制或调节的资源分配
Source: NVD (National Vulnerability Database)
Vulnerability Title
Red Hat Undertow 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Red Hat Undertow是美国红帽（Red Hat）公司的一款基于Java的嵌入式Web服务器，是Wildfly（Java应用服务器）默认的Web服务器。 Red Hat Undertow存在安全漏洞，该漏洞源于容易受到HTTP/2 DDoS攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
-- 0 ~ 2.2.38.Final -
Red HatRed Hat build of Apache Camel 4.14.2 for Spring Boot 3.5.8-cpe:/a:redhat:apache_camel_spring_boot:4.14
Red HatRed Hat JBoss Enterprise Application Platform 2.2.39.Final-redhat-00001 ~ * cpe:/a:redhat:jboss_enterprise_application_platform:7.4
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 0:2.2.39-1.Final_redhat_00001.1.el7eap ~ * cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 0:7.4.24-4.GA_redhat_00002.1.el7eap ~ * cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 0:2.2.39-1.Final_redhat_00001.1.el8eap ~ * cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 0:7.4.24-4.GA_redhat_00002.1.el8eap ~ * cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 0:2.2.39-1.Final_redhat_00001.1.el9eap ~ * cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 0:7.4.24-4.GA_redhat_00002.1.el9eap ~ * cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9
Red HatRed Hat JBoss Enterprise Application Platform 8.0-cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
Red HatRed Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 0:1.83.0-1.redhat_00001.1.el8eap ~ * cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
Red HatRed Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 0:33.0.0-2.jre_redhat_00003.1.el8eap ~ * cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
Red HatRed Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 0:4.0.6-1.redhat_00001.1.el8eap ~ * cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
Red HatRed Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 0:1.0.0-3.redhat_00009.1.el8eap ~ * cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
Red HatRed Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 0:2.0.2-1.Final_redhat_00001.1.el8eap ~ * cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
Red HatRed Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 0:2.3.23-1.SP3_redhat_00001.1.el8eap ~ * cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
Red HatRed Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 0:1.83.0-1.redhat_00001.1.el9eap ~ * cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
Red HatRed Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 0:33.0.0-2.jre_redhat_00003.1.el9eap ~ * cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
Red HatRed Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 0:4.0.6-1.redhat_00001.1.el9eap ~ * cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
Red HatRed Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 0:1.0.0-3.redhat_00009.1.el9eap ~ * cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
Red HatRed Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 0:2.0.2-1.Final_redhat_00001.1.el9eap ~ * cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
Red HatRed Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 0:2.3.23-1.SP3_redhat_00001.1.el9eap ~ * cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
Red HatRed Hat JBoss Enterprise Application Platform 8.1-cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 0:2.3.20-2.SP4_redhat_00001.1.el8eap ~ * cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 0:2.3.20-2.SP4_redhat_00001.1.el9eap ~ * cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
Red HatRed Hat build of Apache Camel - HawtIO 4-cpe:/a:redhat:apache_camel_hawtio:4
Red HatRed Hat Data Grid 8-cpe:/a:redhat:jboss_data_grid:8
Red HatRed Hat Enterprise Linux 10-cpe:/o:redhat:enterprise_linux:10
Red HatRed Hat Enterprise Linux 8-cpe:/o:redhat:enterprise_linux:8
Red HatRed Hat Enterprise Linux 8-cpe:/o:redhat:enterprise_linux:8
Red HatRed Hat Enterprise Linux 9-cpe:/o:redhat:enterprise_linux:9
Red HatRed Hat Fuse 7-cpe:/a:redhat:jboss_fuse:7
Red HatRed Hat JBoss Enterprise Application Platform 7-cpe:/a:redhat:jboss_enterprise_application_platform:7
Red HatRed Hat JBoss Enterprise Application Platform 8-cpe:/a:redhat:jboss_enterprise_application_platform:8
Red HatRed Hat JBoss Enterprise Application Platform 8-cpe:/a:redhat:jboss_enterprise_application_platform:8
Red HatRed Hat JBoss Enterprise Application Platform Expansion Pack-cpe:/a:redhat:jbosseapxp
Red HatRed Hat JBoss Enterprise Application Platform Expansion Pack-cpe:/a:redhat:jbosseapxp
Red HatRed Hat Process Automation 7-cpe:/a:redhat:jboss_enterprise_bpms_platform:7
Red HatRed Hat Single Sign-On 7-cpe:/a:redhat:red_hat_single_sign_on:7

II. Public POCs for CVE-2025-9784

#POC DescriptionSource LinkShenlong Link
1Nonehttps://github.com/drackyjr/CVE-2025-9784POC Details
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-9784

请登录查看更多情报信息。

IV. Related Vulnerabilities

Same weakness: CWE-770

V. Comments for CVE-2025-9784

No comments yet

Leave a comment