GitStock

undertow-io/undertow · Security

Undertow MadeYouReset HTTP/2 DDoS Vulnerability

GHSA ID
GHSA-95h4-w6j8-2rp8
CVE ID
CVE-2025-9784
Severity
high
Published
Updated
CVSS
7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v3
7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Description

A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).

CWEs

  • CWE-404 · Improper Resource Shutdown or Release
  • CWE-770 · Allocation of Resources Without Limits or Throttling

References

Open GitHub