Undertow: undertow madeyoureset http/2 ddos vulnerability

Summary

A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).

Timeline

1. Sep 2, 2025, 1:37 PM UTCCVE published
2. Sep 2, 2025, 1:55 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: partial

3. Oct 14, 2026, 4:27 PM UTCRecord last updated

Affected versions

• undertow

  fixed in 2.2.38.Final

• undertow-core

  Version range not reported

• eap7-undertow

  Version range not reported

• eap7-undertow

  Version range not reported

• io.undertow/undertow-core

  Version range not reported

• eap7-undertow

  Version range not reported

• eap7-wildfly

  Version range not reported

• eap7-undertow

  Version range not reported

• eap7-wildfly

  Version range not reported

• eap7-undertow

  Version range not reported

• eap7-wildfly

  Version range not reported

• undertow-core

  Version range not reported

• eap8-bouncycastle

  Version range not reported

• eap8-guava-libraries

  Version range not reported

• eap8-jaxb

  Version range not reported

• eap8-jcip-annotations

  Version range not reported

• eap8-slf4j-jboss-logmanager

  Version range not reported

• eap8-undertow

  Version range not reported

• eap8-bouncycastle

  Version range not reported

• eap8-guava-libraries

  Version range not reported

• eap8-jaxb

  Version range not reported

• eap8-jcip-annotations

  Version range not reported

• eap8-slf4j-jboss-logmanager

  Version range not reported

• eap8-undertow

  Version range not reported

• io.undertow/undertow-core

  Version range not reported

• eap8-apache-cxf

  Version range not reported

• eap8-bouncycastle

  Version range not reported

• eap8-eap-product-conf-parent

  Version range not reported

• eap8-eventstream

  Version range not reported

• eap8-hibernate

  Version range not reported

• eap8-jboss-el-api_5.0_spec

  Version range not reported

• eap8-jboss-threads

  Version range not reported

• eap8-undertow

  Version range not reported

• eap8-wildfly

  Version range not reported

• eap8-wildfly-clustering

  Version range not reported

• eap8-wildfly-elytron

  Version range not reported

• eap8-wildfly-javadocs

  Version range not reported

• eap8-apache-cxf

  Version range not reported

• eap8-bouncycastle

  Version range not reported

• eap8-eap-product-conf-parent

  Version range not reported

• eap8-eventstream

  Version range not reported

• eap8-hibernate

  Version range not reported

• eap8-jboss-el-api_5.0_spec

  Version range not reported

• eap8-jboss-threads

  Version range not reported

• eap8-undertow

  Version range not reported

• eap8-wildfly

  Version range not reported

• eap8-wildfly-clustering

  Version range not reported

• eap8-wildfly-elytron

  Version range not reported

• eap8-wildfly-javadocs

  Version range not reported

• undertow-core

  Version range not reported

• rh-sso7-keycloak

  Version range not reported

• rh-sso7-keycloak

  Version range not reported

• rh-sso7-keycloak

  Version range not reported

• rh-sso-7/sso76-openshift-rhel8

  Version range not reported

• undertow-core

  Version range not reported

• undertow-core

  Version range not reported

• moditect

  Version range not reported

• pki-core:10.6/resteasy

  Version range not reported

• pki-deps:10.6/resteasy

  Version range not reported

• resteasy

  Version range not reported

• undertow-core

  Version range not reported

• undertow-core

  Version range not reported

• org.jberet-jberet-parent

  Version range not reported

• org.jboss.eap-jboss-eap-xp

  Version range not reported

• org.jboss.eap-jboss-eap-xp

  Version range not reported

• undertow-core

  Version range not reported

• undertow-core

  Version range not reported

• io.undertow:undertow-coreMaven

  fixed in 2.2.38.Final

• io.undertow:undertow-coreMaven

  From 2.3.0.Alpha1 · fixed in 2.3.20.Final

References 24