VulnerabilityModified

CVE-2025-9784

This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts.

HIGH 7.5EPSS 2.33%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (2.33%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 2.33% probability · 83th percentile
CISA KEV: Not listed
Weakness: CWE-770, CWE-404
Affected: redhat/build of apache camel for spring boot · redhat/fuse · redhat/jboss enterprise application platform · redhat/jboss enterprise application platform expansion pack · redhat/process automation · redhat/single sign-on · redhat/undertow · redhat/enterprise linux
Source: secalert@redhat.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.