Description
A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | undertow | < 2.2.38.Final | 2.2.38.Final |
| Red Hat | Red Hat build of Apache Camel 4.14.2 for Spring Boot 3.5.8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4.24 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1.3 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 | — | — |
| Red Hat | Red Hat Single Sign-On 7.6.13 | — | — |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 7 | — | — |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 8 | — | — |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 9 | — | — |
| Red Hat | RHEL-8 based Middleware Containers | — | — |
| Red Hat | Red Hat build of Apache Camel - HawtIO 4 | — | — |
| Red Hat | Red Hat Data Grid 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Fuse 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — | — |
| Red Hat | Red Hat Process Automation 7 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | undertow | 2.3.20-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | resteasy +1 | No fix yet | — |
| Ubuntu 26.04 LTS | resteasy +1 | No fix yet | — |
| Ubuntu 25.10 | resteasy +1 | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | resteasy +1 | No fix yet | — |
| Ubuntu Pro 22.04 LTS | resteasy +1 | No fix yet | — |
| Ubuntu Pro 20.04 LTS | resteasy +1 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | undertow | No fix yet | — |
| Ubuntu Pro 16.04 LTS | resteasy +1 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Single Sign On 7 | rh-sso7-keycloak +1 | 18.0.20-1.redhat_00001.1.el7sso | RHSA-2026:76130, RHSA-2026:76129, RHSA-2026:76128 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-apache-cxf +3 | 3.1.16-7.redhat_00007.1.ep7.el7 | RHSA-2026:33372, RHSA-2026:33371 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-undertow | 1.4.18-21.SP19_redhat_00001.1.ep7.el7 | RHSA-2026:33372, RHSA-2026:33371 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly +4 | 7.3.18-3.GA_redhat_00001.1.el7eap | RHSA-2026:33371 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-apache-cxf +3 | 3.5.11-1.SP1_redhat_00001.1.el7eap | RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-eclipse-jgit | 5.13.5.202508271544-2.r_redhat_00001.1.el7eap | RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-hibernate +4 | 5.3.38-1.Final_redhat_00001.1.el7eap | RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-jboss-marshalling +1 | 2.0.16-1.Final_redhat_00001.1.el7eap | RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-netty +26 | 4.1.124-1.Final_redhat_00001.1.el7eap | RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-undertow | 2.2.39-1.Final_redhat_00001.1.el7eap | RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-wildfly +4 | 7.4.24-4.GA_redhat_00002.1.el7eap | RHSA-2026:4917, RHSA-2026:4916, RHSA-2026:4915 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-wildfly-java-jdk17 | 7.4.24-4.GA_redhat_00002.1.el8eap | RHSA-2026:4917, RHSA-2026:4916 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 8 | eap8-apache-cxf +3 | 4.0.10-1.redhat_00001.1.el8eap | RHSA-2026:0384, RHSA-2026:0383 |
| Red Hat JBoss EAP 8 | eap8-bouncycastle +5 | 1.82.0-1.redhat_00001.1.el8eap | RHSA-2026:3891, RHSA-2026:3889, RHSA-2026:0384 |
| Red Hat JBoss EAP 8 | eap8-eap-product-conf-parent +1 | 801.3.0-1.GA_redhat_00001.1.el8eap | RHSA-2026:0384, RHSA-2026:0383 |
| Red Hat JBoss EAP 8 | eap8-eventstream | 1.0.1-3.redhat_00003.1.el8eap | RHSA-2026:0384, RHSA-2026:0383 |
| Red Hat JBoss EAP 8 | eap8-guava +1 | 33.0.0-2.jre_redhat_00003.1.el8eap | RHSA-2026:3891, RHSA-2026:3889 |
| Red Hat JBoss EAP 8 | eap8-hibernate +2 | 6.6.36-1.Final_redhat_00001.1.el8eap | RHSA-2026:0384, RHSA-2026:0383 |
| Red Hat JBoss EAP 8 | eap8-jaxb +9 | 4.0.6-1.redhat_00001.1.el8eap | RHSA-2026:3891, RHSA-2026:3889 |
| Red Hat JBoss EAP 8 | eap8-jboss-el-api_5.0_spec | 4.0.2-1.Final_redhat_00001.1.el8eap | RHSA-2026:0384, RHSA-2026:0383 |
| Red Hat JBoss EAP 8 | eap8-jboss-threads | 2.5.0-1.redhat_00001.1.el8eap | RHSA-2026:0384, RHSA-2026:0383 |
| Red Hat JBoss EAP 8 | eap8-jcip-annotations | 1.0.0-3.redhat_00009.1.el8eap | RHSA-2026:3891, RHSA-2026:3889 |
| Red Hat JBoss EAP 8 | eap8-slf4j-jboss-logmanager | 2.0.2-1.Final_redhat_00001.1.el8eap | RHSA-2026:3891, RHSA-2026:3889 |
| Red Hat JBoss EAP 8 | eap8-undertow | 2.3.20-2.SP4_redhat_00001.1.el8eap | RHSA-2026:3891, RHSA-2026:3889, RHSA-2026:0384 |
| Red Hat JBoss EAP 8 | eap8-wildfly +3 | 8.1.3-4.GA_redhat_00006.1.el8eap | RHSA-2026:0384, RHSA-2026:0383 |
| Red Hat JBoss EAP 8 | eap8-wildfly-clustering +19 | 5.0.12-1.Final_redhat_00001.1.el8eap | RHSA-2026:0384, RHSA-2026:0383 |
| Red Hat JBoss EAP 8 | eap8-wildfly-elytron +1 | 2.6.6-1.Final_redhat_00001.1.el8eap | RHSA-2026:0384, RHSA-2026:0383 |
| Red Hat JBoss EAP 8 | eap8-wildfly-javadocs | 8.1.1-4.GA_redhat_00007.1.el8eap | RHSA-2026:0384, RHSA-2026:0383 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | wildfly-openjdk-17 +1 | 38.0.0-r0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
drackyjr/CVE-2025-9784 ★ 2 · Sep 2, 2025
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | io.undertow:undertow-core | < 2.2.38.Final | 2.2.38.Final | GHSA-95h4-w6j8-2rp8 |
| Maven | io.undertow:undertow-core | >= 2.3.0.Alpha1, < 2.3.20.Final | 2.3.20.Final | GHSA-95h4-w6j8-2rp8 |
Advisories 14
- RHSA-2026:76130 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.13 security update on RHEL 9 Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:76129 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.13 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:76128 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.13 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:4917 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.24 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:4916 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.24 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:4915 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.24 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:33371 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.18 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:3891 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.12 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:3889 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.12 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:33372 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.15 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:0384 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.3 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:0383 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.3 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- WID-SEC-2026-0054 Red Hat JBoss Enterprise Application Platform (Undertow): Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 29, 2026
- WID-SEC-2025-2204 NetApp ActiveIQ Unified Manager (Undertow): Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Dec 11, 2025
References
- RHSA-2025:23143 vendor-advisory
- RHSA-2026:0383 vendor-advisory
- RHSA-2026:0384 vendor-advisory
- RHSA-2026:0386 vendor-advisory
- RHSA-2026:33371 vendor-advisory
- RHSA-2026:33372 vendor-advisory
- RHSA-2026:3889 vendor-advisory
- RHSA-2026:3891 vendor-advisory
- RHSA-2026:3892 vendor-advisory
- RHSA-2026:4915 vendor-advisory
- RHSA-2026:4916 vendor-advisory
- RHSA-2026:4917 vendor-advisory
- RHSA-2026:4924 vendor-advisory
- RHSA-2026:76128 vendor-advisory
- RHSA-2026:76129 vendor-advisory
- RHSA-2026:76130 vendor-advisory
- RHSA-2026:76132 vendor-advisory
- RHSA-2026:76134 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2025-9784 vdb-entry
- RHBZ#2392306 issue-tracking
- https://github.com/undertow-io/undertow/pull/1778
- https://github.com/undertow-io/undertow/releases/tag/2.2.38.Final
- https://issues.redhat.com/browse/UNDERTOW-2598
- https://kb.cert.org/vuls/id/767506