ZeroDay Findings
Sign inSign up

Findings

CVE-2025-9784

A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters.

Published Sep 2, 2025 · updated Oct 14, 2026 · redhat build of apache camel for spring boot

A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).

Timeline

Detection, updates, and resolution for this record.

  1. Sep 2, 2025 · NIST NVD

    Detected

    A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to ca

  2. Oct 14, 2026 · NIST NVD

    Updated

    A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to ca

Affected

  • cpe redhat/build of apache camel for spring bootversion unspecified
  • cpe redhat/fuse7.0.0
  • cpe redhat/jboss enterprise application platform7.0.0
  • cpe redhat/jboss enterprise application platform8.0.0
  • cpe redhat/jboss enterprise application platform expansion packversion unspecified
  • cpe redhat/process automation7.0
  • cpe redhat/single sign-on7.0
  • cpe redhat/undertowversion unspecified

Sources

  • CVE.orgCVE-2025-9784

    Official CVE identifier

    cve.org
  • NIST NVDCVE-2025-9784

    A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-si

    nvd.nist.gov

References