Undertow: undertow madeyoureset http/2 ddos vulnerability

Vulnerability

Description

CVE-2025-9784 describes a denial of service (DoS) vulnerability in Undertow, an embeddable web server. The flaw, dubbed the "MadeYouReset" attack, arises because the server does not increment abuse counters when handling malformed client requests that trigger server-side stream resets [1][2]. While this is not a protocol-level bug, it exposes a common implementation weakness in the handling of HTTP/2 or similar stream-based connections where rapid resets can be exploited.

Exploitation

An unauthenticated attacker with network access to the Undertow server can repeatedly send crafted requests that cause the server to abort streams internally [3][4]. Because the server fails to register these events in its abuse counter mechanism, there is no throttling or back-pressure applied. The attacker can therefore send a high rate of such requests without being blocked.

Impact

Successful exploitation forces the Undertow server to expend resources processing each reset, leading to excessive CPU and/or memory consumption. Over time, this can degrade performance or completely exhaust server resources, resulting in a denial of service for legitimate clients. The attack does not require any special privileges or knowledge of the internal state beyond the ability to deliver network packets.

Mitigation

Red Hat has released updated packages for Red Hat Enterprise Linux and Red Hat JBoss Enterprise Application Platform (EAP) via RHSA-2026:0384, RHSA-2026:0383, RHSA-2026:3891, and RHSA-2026:3889 to address this flaw [1][2][3][4]. Administrators should apply the relevant updates to ensure the abuse counter mechanism properly tracks and limits stream resets.