Vulnerabilities in pkg:maven/io.undertow/undertow-core

Q: What is CVE-2025-9784?

CVE-2025-9784 is a security vulnerability in Undertow core involving Undertow MadeYouReset HTTP/2 DDoS Vulnerability under CWE-404: Improper Resource Shutdown or Release.

Q: Which Undertow core versions are affected?

Affected versions include releases prior to 2.2.38.Final, 2.3.20.Final across affected packages: io.undertow:undertow-core.

Q: What version fixes CVE-2025-9784?

Upgrading to 2.2.38.Final, 2.3.20.Final (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is undertow-core affected?

Yes, io.undertow:undertow-core is affected in releases prior to 2.2.38.Final, 2.3.20.Final. Upgrade your dependency to 2.2.38.Final, 2.3.20.Final or later.

Q: What is the CVSS score of CVE-2025-9784?

CVE-2025-9784 has a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Q: What CWE is associated with CVE-2025-9784?

CVE-2025-9784 is classified under CWE-404: Improper Resource Shutdown or Release (The product does not release or incorrectly releases a resource before it is made available for re-use.).

Q: How can I check Maven dependencies for CVE-2025-9784?

Run the dependency tree command: 'mvn dependency:tree -Dincludes=io.undertow'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

PACKAGE

Advisory Identifier: GHSA-95h4-w6j8-2rp8

Advisory Summary

CVE-2025-9784 is a HIGH (CVSS 7.5) denial of service vulnerability (CWE-404: Improper Resource Shutdown or Release) affecting Undertow core libraries in the Maven ecosystem. The issue involves undertow madeyoureset http/2 ddos vulnerability. Remediation is available by upgrading affected packages to version 2.2.38.Final, 2.3.20.Final.

40 Known Advisory Record(s)

Package Vulnerability Intelligence

pkg:maven/io.undertow/undertow-core

40 Known Advisory Record(s)

Vulnerability advisories affecting package pkg:maven/io.undertow/undertow-core. Select an advisory below to view technical details or fixes.

Advisory ID	CVE / NVD	Severity	Summary
GHSA-95h4-w6j8-2rp8	CVE-2025-9784	HIGH	Undertow MadeYouReset HTTP/2 DDoS Vulnerability
GHSA-3x3v-w654-m28m	CVE-2026-3260	MODERATE	Undertow: Denial of Service via Multipart/Form-Data Parsing on HTTP GET Requests
GHSA-6h4f-pj3g-q8fq	CVE-2024-3884	HIGH	Undertow OutOfMemory when parsing form data encoding with application/x-www-form-urlencoded
GHSA-j382-5jj3-vw4j	CVE-2025-12543	CRITICAL	Undertow HTTP server core doesn't properly validate the Host header in incoming HTTP requests
GHSA-9442-gm4v-r222	CVE-2024-6162	HIGH	Undertow's url-encoded request path information can be broken on ajp-listener
GHSA-33hj-rcmx-86mv	CVE-2024-4027	HIGH	Undertow Servlets Vulnerable to Remote DoS via OutOfMemoryError when Passed Large Parameter Names
GHSA-9623-mqmm-5rcf	CVE-2024-7885	HIGH	Undertow vulnerable to Race Condition
GHSA-rf6q-vx79-mjxr	CVE-2021-3629	HIGH	Undertow Uncontrolled Resource Consumption
GHSA-w6qf-42m7-vh68	CVE-2024-1635	HIGH	Undertow Uncontrolled Resource Consumption Vulnerability
GHSA-pfcc-3g6r-8rg8	CVE-2022-4492	CRITICAL	Undertow client not checking server identity presented by server certificate in https connections
GHSA-3jrv-jgp8-45v3	CVE-2023-4639	HIGH	Undertow incorrectly parses cookies
GHSA-22c5-cpvr-cfvq	CVE-2024-4109	HIGH	Withdrawn Advisory: undertow: information leakage via HTTP/2 request header reuse
GHSA-v76w-3ph8-vm66	CVE-2024-1459	MODERATE	Undertow Path Traversal vulnerability
GHSA-97cq-f4jm-mv8h	CVE-2023-1973	MODERATE	Undertow Denial of Service vulnerability
GHSA-ch7q-gpff-h9hp	CVE-2024-3653	MODERATE	Undertow Missing Release of Memory after Effective Lifetime vulnerability
GHSA-xpp6-8r3j-ww43	CVE-2024-5971	HIGH	Undertow Denial of Service vulnerability
GHSA-m4mm-pg93-fv78	CVE-2023-1108	HIGH	Undertow denial of service vulnerability
GHSA-5gg7-5wv8-4gcj	CVE-2017-12165	HIGH	Undertow Request Smuggling vulnerability
GHSA-rj76-h87p-r3wf	CVE-2017-7559	MODERATE	Undertow vulnerable to Request Smuggling
GHSA-3f57-w2rp-72fc	CVE-2016-7046	MODERATE	Undertow Uncaught Exception vulnerability
GHSA-vjxc-frw4-jmh5	CVE-2019-14888	HIGH	Undertow vulnerable to Uncontrolled Resource Consumption
GHSA-mcfm-h73v-635m	CVE-2017-2666	MODERATE	Undertow-core vulnerable to HTTP Request Smuggling
GHSA-339q-62wm-c39w	CVE-2021-3859	HIGH	Undertow vulnerable to Denial of Service (DoS) attacks
GHSA-fj7c-vg2v-ccrm	CVE-2021-3690	HIGH	Undertow vulnerable to memory exhaustion due to buffer leak
GHSA-95rf-557x-44g5	CVE-2022-2053	HIGH	Undertow vulnerable to Dos via Large AJP request
GHSA-mfhv-gwf8-4m88	CVE-2021-3597	MODERATE	undertow Race Condition vulnerability
GHSA-h6p6-fc4w-cqhx	CVE-2014-7816	MODERATE	Improper Limitation of a Pathname to a Restricted Directory in JBoss Undertow
GHSA-cp7v-vmv7-6x2q	CVE-2017-12196	MODERATE	Incorrect Authorization in Undertow
GHSA-gjjx-gqm4-wcgm	CVE-2018-1114	MODERATE	Uncontrolled Resource Consumption in Undertow
GHSA-vf6r-mmhc-3xcm	CVE-2018-14642	MODERATE	Exposure of Sensitive Information to an Unauthorized Actor in Undertow
GHSA-2w73-fqqj-c92p	CVE-2020-1757	HIGH	Improper Input Validation in Undertow
GHSA-gv2w-88hx-8m9r	CVE-2020-1745	HIGH	Improper Authorization in Undertoe
GHSA-jwgx-9mmh-684w	CVE-2019-3888	CRITICAL	Credential exposure through log files in Undertow
GHSA-8vh8-vc28-m2hf	CVE-2019-10212	CRITICAL	Potential to access user credentials from the log files when debug logging enabled
GHSA-g4cp-h53p-v3v8	CVE-2020-10705	HIGH	Allocation of Resources Without Limits or Throttling in Undertow
GHSA-cccf-7xw3-p2vr	CVE-2020-10719	MODERATE	HTTP Request Smuggling in Undertow
GHSA-p9w3-gwc2-cr49	CVE-2020-10687	MODERATE	HTTP Request Smuggling in Undertow
GHSA-qjwc-v72v-fq6r	CVE-2021-20220	MODERATE	HTTP request smuggling in Undertow
GHSA-3x7h-5hfr-hvjm	CVE-2017-2670	MODERATE	Moderate severity vulnerability that affects io.undertow:undertow-core
GHSA-rhcw-wjcm-9h6g	CVE-2020-27782	HIGH	Denial of service in Undertow

CVE-2025-9784 at a Glance

CVE Identifier CVE-2025-9784

GHSA Identifier GHSA-95h4-w6j8-2rp8

Severity HIGH

CVSS v3.1 Base Score 7.5

CWE Classification CWE-404: Improper Resource Shutdown or Release

Affected Product Undertow core

Package Ecosystem Maven

Published Date 2025-09-02

Last Updated 2026-10-06

Security Impact

CVSS: 7.5

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality None (C:N)

Integrity None (I:N)

Availability High (A:H)

How to Fix CVE-2025-9784

To remediate this vulnerability, upgrade all affected Undertow core dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

io.undertow:undertow-core fixed: 2.2.38.Final

<dependency>
    <groupId>io.undertow</groupId>
    <artifactId>undertow-core</artifactId>
    <version>2.2.38.Final</version>
</dependency>

io.undertow:undertow-core fixed: 2.3.20.Final

<dependency>
    <groupId>io.undertow</groupId>
    <artifactId>undertow-core</artifactId>
    <version>2.3.20.Final</version>
</dependency>

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

mvn dependency:tree -Dincludes=io.undertow

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2025-9784, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree -Dincludes=io.undertow

Analyze the terminal output to locate any version of Undertow core in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.2.38.Final), your application is affected.

Note: The mvn dependency:tree -Dincludes=io.undertow command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-404: Improper Resource Shutdown or Release, where the product does not release or incorrectly releases a resource before it is made available for re-use. In Undertow core, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).

CVE-2025-9784 Affected Undertow core Versions

2 component(s)

Fixed Versions:

2.2.38.Final2.3.20.Final

Product / Package	Ecosystem	Affected Versions	Fixed Version
io.undertow:undertow-core maven/io.undertow/undertow-core	Maven	< 2.2.38.Final	2.2.38.Final
io.undertow:undertow-core maven/io.undertow/undertow-core	Maven	≥ 2.3.0.Alpha1 < 2.3.20.Final	2.3.20.Final

References

NVD — CVE-2025-9784 NVD

https://nvd.nist.gov/vuln/detail/CVE-2025-9784

Undertow core Source Repository REPOSITORY

https://github.com/undertow-io/undertow/pull/1805

Undertow core Source Repository REPOSITORY

https://github.com/undertow-io/undertow/pull/1804

Undertow core Source Repository REPOSITORY

https://github.com/undertow-io/undertow/pull/1803

Undertow core Source Repository REPOSITORY

https://github.com/undertow-io/undertow/pull/1802

Undertow core Source Repository REPOSITORY

https://github.com/undertow-io/undertow/pull/1778

www.kb.cert.org/vuls/id/767506 WEB

https://www.kb.cert.org/vuls/id/767506

kb.cert.org/vuls/id/767506 WEB

https://kb.cert.org/vuls/id/767506

issues.redhat.com/browse/undertow-259... WEB

https://issues.redhat.com/browse/UNDERTOW-2598

Undertow core Release RELEASE

https://github.com/undertow-io/undertow/releases/tag/2.2.38.Final

Undertow core Source Repository REPOSITORY

https://github.com/undertow-io/undertow

bugzilla.redhat.com/show_bug.cgi WEB

https://bugzilla.redhat.com/show_bug.cgi?id=2392306

Undertow core Security Information SECURITY

https://access.redhat.com/security/cve/CVE-2025-9784

access.redhat.com/errata/rhsa-2026:76... WEB

https://access.redhat.com/errata/RHSA-2026:76134

access.redhat.com/errata/rhsa-2026:76... WEB

https://access.redhat.com/errata/RHSA-2026:76132

access.redhat.com/errata/rhsa-2026:49... WEB

https://access.redhat.com/errata/RHSA-2026:4924

access.redhat.com/errata/rhsa-2026:49... WEB

https://access.redhat.com/errata/RHSA-2026:4917

access.redhat.com/errata/rhsa-2026:49... WEB

https://access.redhat.com/errata/RHSA-2026:4916

access.redhat.com/errata/rhsa-2026:49... WEB

https://access.redhat.com/errata/RHSA-2026:4915

access.redhat.com/errata/rhsa-2026:38... WEB

https://access.redhat.com/errata/RHSA-2026:3892

access.redhat.com/errata/rhsa-2026:38... WEB

https://access.redhat.com/errata/RHSA-2026:3891

access.redhat.com/errata/rhsa-2026:38... WEB

https://access.redhat.com/errata/RHSA-2026:3889

access.redhat.com/errata/rhsa-2026:33... WEB

https://access.redhat.com/errata/RHSA-2026:33372

access.redhat.com/errata/rhsa-2026:33... WEB

https://access.redhat.com/errata/RHSA-2026:33371

access.redhat.com/errata/rhsa-2026:03... WEB

https://access.redhat.com/errata/RHSA-2026:0386

access.redhat.com/errata/rhsa-2026:03... WEB

https://access.redhat.com/errata/RHSA-2026:0384

access.redhat.com/errata/rhsa-2026:03... WEB

https://access.redhat.com/errata/RHSA-2026:0383

access.redhat.com/errata/rhsa-2025:23... WEB

https://access.redhat.com/errata/RHSA-2025:23143

Frequently Asked Questions

What is CVE-2025-9784?

CVE-2025-9784 is a security vulnerability in Undertow core involving Undertow MadeYouReset HTTP/2 DDoS Vulnerability under CWE-404: Improper Resource Shutdown or Release.

Which Undertow core versions are affected?

Affected versions include releases prior to 2.2.38.Final, 2.3.20.Final across affected packages: io.undertow:undertow-core.

What version fixes CVE-2025-9784?

Upgrading to 2.2.38.Final, 2.3.20.Final (or the latest patched release for your respective branch) resolves the vulnerability.

Is undertow-core affected?

Yes, io.undertow:undertow-core is affected in releases prior to 2.2.38.Final, 2.3.20.Final. Upgrade your dependency to 2.2.38.Final, 2.3.20.Final or later.

What is the CVSS score of CVE-2025-9784?

CVE-2025-9784 has a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

What CWE is associated with CVE-2025-9784?

CVE-2025-9784 is classified under CWE-404: Improper Resource Shutdown or Release (The product does not release or incorrectly releases a resource before it is made available for re-use.).

How can I check Maven dependencies for CVE-2025-9784?

Run the dependency tree command: 'mvn dependency:tree -Dincludes=io.undertow'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-95h4-w6j8-2rp8",
  "modified" : "2026-10-06T00:32:48Z",
  "published" : "2025-09-02T15:31:08Z",
  "aliases" : [ "CVE-2025-9784" ],
  "summary" : "Undertow MadeYouReset HTTP/2 DDoS Vulnerability",
  "details" : "A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the \"MadeYouReset\" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "io.undertow:undertow-core"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.2.38.Final"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "io.undertow:undertow-core"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.3.0.Alpha1"
      }, {
        "fixed" : "2.3.20.Final"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-9784"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/undertow-io/undertow/pull/1805"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/undertow-io/undertow/pull/1804"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/undertow-io/undertow/pull/1803"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/undertow-io/undertow/pull/1802"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/undertow-io/undertow/pull/1778"
  }, {
    "type" : "WEB",
    "url" : "https://www.kb.cert.org/vuls/id/767506"
  }, {
    "type" : "WEB",
    "url" : "https://kb.cert.org/vuls/id/767506"
  }, {
    "type" : "WEB",
    "url" : "https://issues.redhat.com/browse/UNDERTOW-2598"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/undertow-io/undertow/releases/tag/2.2.38.Final"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/undertow-io/undertow"
  }, {
    "type" : "WEB",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2392306"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/security/cve/CVE-2025-9784"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:76134"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:76132"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:4924"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:4917"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:4916"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:4915"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:3892"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:3891"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:3889"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:33372"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:33371"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:0386"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:0384"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2026:0383"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2025:23143"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-404", "CWE-770" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-09-02T20:54:27Z",
    "nvd_published_at" : "2025-09-02T14:15:36Z"
  }
}

CVSS V3

7.5 HIGH

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality None (C:N)

Integrity None (I:N)

Availability High (A:H)

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Advisory Metadata

Source ID: GHSA-95h4-w6j8-2rp8
Schema Version: 1.4.0
Published: 2025-09-02 15:31
Last Modified: 2026-10-06 00:32
Database Record File: advisories/github-reviewed/2025/09/GHSA-95h4-w6j8-2rp8/GHSA-95h4-w6j8-2rp8.json