Undertow MadeYouReset HTTP/2 DDoS Vulnerability
A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-9784US | — | Exploit | ||
A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset"… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/errata/RHSA-2025:23143WEB
- https://access.redhat.com/errata/RHSA-2026:0383WEB
- https://access.redhat.com/errata/RHSA-2026:0384WEB
- https://access.redhat.com/errata/RHSA-2026:0386WEB
- https://access.redhat.com/errata/RHSA-2026:33371WEB
- https://access.redhat.com/errata/RHSA-2026:33372WEB
- https://access.redhat.com/errata/RHSA-2026:3889WEB
- https://access.redhat.com/errata/RHSA-2026:3891WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan