Description
A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).
Problem types
Allocation of Resources Without Limits or Throttling
Product status
Timeline
| 2025-09-01: | Reported to Red Hat. |
| 2025-09-01: | Made public. |
References
access.redhat.com/security/cve/CVE-2025-9784
bugzilla.redhat.com/show_bug.cgi?id=2392306 (RHBZ#2392306)
github.com/undertow-io/undertow/pull/1778
issues.redhat.com/browse/UNDERTOW-2598
