Undertow: undertow madeyoureset http/2 ddos vulnerability (CVE-2025-9784)

Why this deserves its current priority

CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps io.undertow:undertow-core (maven), io.undertow:undertow-core (maven), io.undertow:undertow-core (maven), io.undertow:undertow-core (maven). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
io.undertow:undertow-coremaven	<2.2.38.Final	2.2.38.Final
io.undertow:undertow-coremaven	>=2.3.0.Alpha1,<2.3.20.Final	2.3.20.Final
io.undertow:undertow-coremaven	>=0 <2.2.38.Final	2.2.38.Final
io.undertow:undertow-coremaven	>=2.3.0.Alpha1 <2.3.20.Final	2.3.20.Final

Recommended response

Check inventory. Check lockfiles and deployed manifests for io.undertow:undertow-core, io.undertow:undertow-core, io.undertow:undertow-core.
Review the reported fix. Update io.undertow:undertow-core to 2.2.38.Final; io.undertow:undertow-core to 2.3.20.Final; io.undertow:undertow-core to 2.2.38.Final; io.undertow:undertow-core to 2.3.20.Final if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Sep 2, 2025
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Aug 19, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Jun 25, 2026

Sources and claim methodology

Upstream source description

A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).

Quoted source text, attributed separately from HOL analysis.