Undertow: undertow madeyoureset http/2 ddos vulnerability
Priority MEDIUM 43CWE-770Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 18 fixed, 5 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.
Summary
A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02325 83rd percentileScored 2026-11-07
Fix Partial undertow: 2.2.38.Finalio.undertow:undertow-core (Maven): 2.2.38.Final, 2.3.20.FinalRed Hat: 18 advisoriesRed Hat: 18 fixed, 5 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | undertow | before 2.2.38.Final | 2.2.38.Final | Patch available | CNA |
| Red Hat | Red Hat build of Apache Camel 4.14.2 for Spring Boot 3.5.8 | — | — | Not affected | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 | — | 1.4.18-21.SP19_redhat_00001.1.ep7.el7 | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | — | 2.0.41-8.SP9_redhat_00001.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4.24 | — | 2.2.39.Final-redhat-00001 | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | — | 2.2.39-1.Final_redhat_00001.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | — | 7.4.24-4.GA_redhat_00002.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | — | 2.2.39-1.Final_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 | — | 7.4.24-4.GA_redhat_00002.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 | — | 2.2.39-1.Final_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 | — | 7.4.24-4.GA_redhat_00002.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 | — | — | Not affected | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | — | 1.83.0-1.redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | — | 33.0.0-2.jre_redhat_00003.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | — | 4.0.6-1.redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | — | 1.0.0-3.redhat_00009.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | — | 2.0.2-1.Final_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | — | 2.3.23-1.SP3_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | — | 1.83.0-1.redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | — | 33.0.0-2.jre_redhat_00003.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | — | 4.0.6-1.redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | — | 1.0.0-3.redhat_00009.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | — | 2.0.2-1.Final_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | — | 2.3.23-1.SP3_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1.3 | — | 2.3.20.SP4-redhat-00001 | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 | — | 4.0.10-1.redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 | — | 1.82.0-1.redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 | — | 801.3.0-1.GA_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 | — | 1.0.1-3.redhat_00003.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 | — | 6.6.36-1.Final_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 | — | 4.0.2-1.Final_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 | — | 2.5.0-1.redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 | — | 2.3.20-2.SP4_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 | — | 8.1.3-4.GA_redhat_00006.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 | — | 5.0.12-1.Final_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 | — | 2.6.6-1.Final_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 | — | 8.1.1-4.GA_redhat_00007.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 | — | 4.0.10-1.redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 | — | 1.82.0-1.redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 | — | 801.3.0-1.GA_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 | — | 1.0.1-3.redhat_00003.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 | — | 6.6.36-1.Final_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 | — | 4.0.2-1.Final_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 | — | 2.5.0-1.redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 | — | 2.3.20-2.SP4_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 | — | 8.1.3-4.GA_redhat_00006.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 | — | 5.0.12-1.Final_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 | — | 2.6.6-1.Final_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 | — | 8.1.1-4.GA_redhat_00007.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat Single Sign-On 7.6.13 | — | — | Not affected | CNA |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 7 | — | 18.0.20-1.redhat_00001.1.el7sso | Patch available | CNA |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 8 | — | 18.0.20-1.redhat_00001.1.el8sso | Patch available | CNA |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 9 | — | 18.0.20-1.redhat_00001.1.el9sso | Patch available | CNA |
| Red Hat | RHEL-8 based Middleware Containers | — | 7.6-85 | Patch available | CNA |
| Red Hat | Red Hat build of Apache Camel - HawtIO 4 | — | — | Not affected | CNA |
| Red Hat | Red Hat Data Grid 8 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Enterprise Linux 10 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | — | Not affected | CNA |
| Red Hat | Red Hat Fuse 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | — | — | Not affected | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | — | — | Not affected | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — | — | No fix listed | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — | — | Not affected | CNA |
| Red Hat | Red Hat Process Automation 7 | — | — | No fix listed | CNA |
| — | io.undertow:undertow-core (Maven) | before 2.2.38.Final | 2.2.38.Final | Patch available | GHSA-95h4-w6j8-2rp8 |
| — | io.undertow:undertow-core (Maven) | 2.3.0.Alpha1 to before 2.3.20.Final | 2.3.20.Final | Patch available | GHSA-95h4-w6j8-2rp8 |
- undertow Vendor— Affected before 2.2.38.Final Fixed in 2.2.38.Final Patch available CNA
- Red Hat build of Apache Camel 4.14.2 for Spring Boot 3.5.8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 1.4.18-21.SP19_redhat_00001.1.ep7.el7 Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 2.0.41-8.SP9_redhat_00001.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4.24 VendorRed Hat Affected — Fixed in 2.2.39.Final-redhat-00001 Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 VendorRed Hat Affected — Fixed in 2.2.39-1.Final_redhat_00001.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 VendorRed Hat Affected — Fixed in 7.4.24-4.GA_redhat_00002.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 VendorRed Hat Affected — Fixed in 2.2.39-1.Final_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 VendorRed Hat Affected — Fixed in 7.4.24-4.GA_redhat_00002.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 VendorRed Hat Affected — Fixed in 2.2.39-1.Final_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 VendorRed Hat Affected — Fixed in 7.4.24-4.GA_redhat_00002.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 VendorRed Hat Affected — Fixed in 1.83.0-1.redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 VendorRed Hat Affected — Fixed in 33.0.0-2.jre_redhat_00003.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 VendorRed Hat Affected — Fixed in 4.0.6-1.redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 VendorRed Hat Affected — Fixed in 1.0.0-3.redhat_00009.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 VendorRed Hat Affected — Fixed in 2.0.2-1.Final_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 VendorRed Hat Affected — Fixed in 2.3.23-1.SP3_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 VendorRed Hat Affected — Fixed in 1.83.0-1.redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 VendorRed Hat Affected — Fixed in 33.0.0-2.jre_redhat_00003.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 VendorRed Hat Affected — Fixed in 4.0.6-1.redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 VendorRed Hat Affected — Fixed in 1.0.0-3.redhat_00009.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 VendorRed Hat Affected — Fixed in 2.0.2-1.Final_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 VendorRed Hat Affected — Fixed in 2.3.23-1.SP3_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.1.3 VendorRed Hat Affected — Fixed in 2.3.20.SP4-redhat-00001 Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 VendorRed Hat Affected — Fixed in 4.0.10-1.redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 VendorRed Hat Affected — Fixed in 1.82.0-1.redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 VendorRed Hat Affected — Fixed in 801.3.0-1.GA_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 VendorRed Hat Affected — Fixed in 1.0.1-3.redhat_00003.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 VendorRed Hat Affected — Fixed in 6.6.36-1.Final_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 VendorRed Hat Affected — Fixed in 4.0.2-1.Final_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 VendorRed Hat Affected — Fixed in 2.5.0-1.redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 VendorRed Hat Affected — Fixed in 2.3.20-2.SP4_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 VendorRed Hat Affected — Fixed in 8.1.3-4.GA_redhat_00006.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 VendorRed Hat Affected — Fixed in 5.0.12-1.Final_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 VendorRed Hat Affected — Fixed in 2.6.6-1.Final_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 VendorRed Hat Affected — Fixed in 8.1.1-4.GA_redhat_00007.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 VendorRed Hat Affected — Fixed in 4.0.10-1.redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 VendorRed Hat Affected — Fixed in 1.82.0-1.redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 VendorRed Hat Affected — Fixed in 801.3.0-1.GA_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 VendorRed Hat Affected — Fixed in 1.0.1-3.redhat_00003.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 VendorRed Hat Affected — Fixed in 6.6.36-1.Final_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 VendorRed Hat Affected — Fixed in 4.0.2-1.Final_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 VendorRed Hat Affected — Fixed in 2.5.0-1.redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 VendorRed Hat Affected — Fixed in 2.3.20-2.SP4_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 VendorRed Hat Affected — Fixed in 8.1.3-4.GA_redhat_00006.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 VendorRed Hat Affected — Fixed in 5.0.12-1.Final_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 VendorRed Hat Affected — Fixed in 2.6.6-1.Final_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 VendorRed Hat Affected — Fixed in 8.1.1-4.GA_redhat_00007.1.el9eap Patch available CNA
- Red Hat Single Sign-On 7.6.13 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Single Sign-On 7.6 for RHEL 7 VendorRed Hat Affected — Fixed in 18.0.20-1.redhat_00001.1.el7sso Patch available CNA
- Red Hat Single Sign-On 7.6 for RHEL 8 VendorRed Hat Affected — Fixed in 18.0.20-1.redhat_00001.1.el8sso Patch available CNA
- Red Hat Single Sign-On 7.6 for RHEL 9 VendorRed Hat Affected — Fixed in 18.0.20-1.redhat_00001.1.el9sso Patch available CNA
- RHEL-8 based Middleware Containers VendorRed Hat Affected — Fixed in 7.6-85 Patch available CNA
- Red Hat build of Apache Camel - HawtIO 4 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Data Grid 8 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Fuse 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat JBoss Enterprise Application Platform 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat JBoss Enterprise Application Platform 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat JBoss Enterprise Application Platform 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat JBoss Enterprise Application Platform Expansion Pack VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat JBoss Enterprise Application Platform Expansion Pack VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Process Automation 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- io.undertow:undertow-core (Maven) Vendor— Affected before 2.2.38.Final Fixed in 2.2.38.Final Patch available GHSA-95h4-w6j8-2rp8
- io.undertow:undertow-core (Maven) Vendor— Affected 2.3.0.Alpha1 to before 2.3.20.Final Fixed in 2.3.20.Final Patch available GHSA-95h4-w6j8-2rp8
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:build_of_apache_camel_for_spring_boot:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:fuse:7.0.0:*:*:*:*:*:*:* | 7.0.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:* | 7.0.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:8.0.0:*:*:*:*:*:*:* | 8.0.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_application_platform_expansion_pack:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:undertow:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:-:*:*:* | 8.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Red Hat |
- cpe:2.3:a:redhat:build_of_apache_camel_for_spring_boot:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:fuse:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:8.0.0:*:*:*:*:*:*:* Versions 8.0.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_application_platform_expansion_pack:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:undertow:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:-:*:*:* Versions 8.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
Remediation
- Fix · CNA undertow Fixed in 2.2.38.Final
- Fix · GHSA-95h4-w6j8-2rp8 io.undertow:undertow-core (Maven) Fixed in 2.2.38.Final Advisory →
- Fix · GHSA-95h4-w6j8-2rp8 io.undertow:undertow-core (Maven) Fixed in 2.3.20.Final Advisory →
Red Hat 18 advisories
- RHSA-2026:76128 Released 2026-10-06 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.13 security update on RHEL 7
- Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak-18.0.20-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server-18.0.20-1.redhat_00001.1.el7sso
- RHSA-2026:76130 Released 2026-10-06 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.13 security update on RHEL 9
- Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak-18.0.20-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server-18.0.20-1.redhat_00001.1.el9sso
- RHSA-2026:76129 Released 2026-10-06 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.13 security update on RHEL 8
- Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak-18.0.20-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-18.0.20-1.redhat_00001.1.el8sso
Show 15 more Red Hat advisories
- RHSA-2026:76134 Released 2026-10-05 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.13 for OpenShift image security update
- Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8
- RHSA-2026:76132 Released 2026-10-05 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.13 security update
- Red Hat Single Sign-On 7.6.13
- RHSA-2026:33371 Released 2026-06-30 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.3.18 security update
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-apache-cxf-3.4.10-4.SP2_redhat_00004.1.el7eap, eap7-apache-cxf-rt-3.4.10-4.SP2_redhat_00004.1.el7eap, eap7-apache-cxf-services-3.4.10-4.SP2_redhat_00004.1.el7eap +7
- RHSA-2026:33372 Released 2026-06-30 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.1.15 security update
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-apache-cxf-3.1.16-7.redhat_00007.1.ep7.el7, eap7-apache-cxf-rt-3.1.16-7.redhat_00007.1.ep7.el7, eap7-apache-cxf-services-3.1.16-7.redhat_00007.1.ep7.el7 +2
- RHSA-2026:4924 Released 2026-03-18 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.24 security update
- Red Hat JBoss Enterprise Application Platform 7.4.24 io.netty.netty-codec-http2-4.1.124.Final-redhat-00001.jar, io.undertow.undertow-core-2.2.39.Final-redhat-00001.jar, org.apache.cxf.cxf-rt-transports-jms-3.5.11.SP1-redhat-00001.jar +2
- RHSA-2026:4917 Released 2026-03-18 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.24 security update
- Red Hat JBoss EAP 7.4 ELS for RHEL 9 eap7-apache-cxf-3.5.11-1.SP1_redhat_00001.1.el9eap, eap7-apache-cxf-rt-3.5.11-1.SP1_redhat_00001.1.el9eap, eap7-apache-cxf-services-3.5.11-1.SP1_redhat_00001.1.el9eap +40
- RHSA-2026:4915 Released 2026-03-18 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.24 security update
- Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server eap7-apache-cxf-3.5.11-1.SP1_redhat_00001.1.el7eap, eap7-apache-cxf-rt-3.5.11-1.SP1_redhat_00001.1.el7eap, eap7-apache-cxf-services-3.5.11-1.SP1_redhat_00001.1.el7eap +42
- RHSA-2026:4916 Released 2026-03-18 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.24 security update
- Red Hat JBoss EAP 7.4 ELS for RHEL 8 eap7-apache-cxf-3.5.11-1.SP1_redhat_00001.1.el8eap, eap7-apache-cxf-rt-3.5.11-1.SP1_redhat_00001.1.el8eap, eap7-apache-cxf-services-3.5.11-1.SP1_redhat_00001.1.el8eap +43
- RHSA-2026:3889 Released 2026-03-05 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 8.0.12 security update
- Red Hat JBoss EAP 8.0 for RHEL 8 eap8-bouncycastle-1.83.0-1.redhat_00001.1.el8eap, eap8-bouncycastle-jmail-1.83.0-1.redhat_00001.1.el8eap, eap8-bouncycastle-pg-1.83.0-1.redhat_00001.1.el8eap +18
- RHSA-2026:3891 Released 2026-03-05 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 8.0.12 security update
- Red Hat JBoss EAP 8.0 for RHEL 9 eap8-bouncycastle-1.83.0-1.redhat_00001.1.el9eap, eap8-bouncycastle-jmail-1.83.0-1.redhat_00001.1.el9eap, eap8-bouncycastle-pg-1.83.0-1.redhat_00001.1.el9eap +18
- RHSA-2026:3892 Released 2026-03-05 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 8.0.12 security update
- Red Hat JBoss Enterprise Application Platform 8.0
- RHSA-2026:0384 Released 2026-01-08 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 8.1.3 security update
- Red Hat JBoss EAP 8.1 for RHEL 9 eap8-apache-cxf-4.0.10-1.redhat_00001.1.el9eap, eap8-apache-cxf-rt-4.0.10-1.redhat_00001.1.el9eap, eap8-apache-cxf-services-4.0.10-1.redhat_00001.1.el9eap +43
- RHSA-2026:0383 Released 2026-01-08 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 8.1.3 security update
- Red Hat JBoss EAP 8.1 for RHEL 8 eap8-apache-cxf-4.0.10-1.redhat_00001.1.el8eap, eap8-apache-cxf-rt-4.0.10-1.redhat_00001.1.el8eap, eap8-apache-cxf-services-4.0.10-1.redhat_00001.1.el8eap +43
- RHSA-2026:0386 Released 2026-01-08 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 8.1.3 security update
- Red Hat JBoss Enterprise Application Platform 8.1.3 io.undertow.undertow-core-2.3.20.SP4-redhat-00001.jar
- RHSA-2025:23143 Released 2025-12-11 · Red Hat rating CriticalRed Hat Build of Apache Camel 4.14.2 for Spring Boot release.
- Red Hat build of Apache Camel 4.14.2 for Spring Boot 3.5.8
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Data Grid 8 | Affected | No fix planned: Will not fix |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Enterprise Application Platform 7 | Affected | No fix yet |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet |
| Red Hat Process Automation 7 | Affected | No fix planned: Will not fix |
| Middleware Containers for OpenShift | Fixed | RHSA-2026:76134 |
| Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server | Fixed | RHSA-2026:4915 |
| Red Hat JBoss EAP 7.4 ELS for RHEL 8 | Fixed | RHSA-2026:4916 |
| Red Hat JBoss EAP 7.4 ELS for RHEL 9 | Fixed | RHSA-2026:4917 |
| Red Hat JBoss EAP 8.0 for RHEL 8 | Fixed | RHSA-2026:3889 |
| Red Hat JBoss EAP 8.0 for RHEL 9 | Fixed | RHSA-2026:3891 |
| Red Hat JBoss EAP 8.1 for RHEL 8 | Fixed | RHSA-2026:0383 |
| Red Hat JBoss EAP 8.1 for RHEL 9 | Fixed | RHSA-2026:0384 |
| Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server | Fixed | RHSA-2026:33372 |
| Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server | Fixed | RHSA-2026:33371 |
| Red Hat JBoss Enterprise Application Platform 7.4.24 | Fixed | RHSA-2026:4924 |
| Red Hat JBoss Enterprise Application Platform 8.0 | Fixed | RHSA-2026:3892 |
| Red Hat JBoss Enterprise Application Platform 8.1.3 | Fixed | RHSA-2026:0386 |
| Red Hat Single Sign-On 7.6 for RHEL 7 Server | Fixed | RHSA-2026:76128 |
| Red Hat Single Sign-On 7.6 for RHEL 8 | Fixed | RHSA-2026:76129 |
| Red Hat Single Sign-On 7.6 for RHEL 9 | Fixed | RHSA-2026:76130 |
| Red Hat Single Sign-On 7.6.13 | Fixed | RHSA-2026:76132 |
| Red Hat build of Apache Camel 4.14.2 for Spring Boot 3.5.8 | Fixed | RHSA-2025:23143 |
Not affected: 15 products
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server
- Red Hat JBoss EAP 7.4 ELS for RHEL 8
- Red Hat JBoss EAP 7.4 ELS for RHEL 9
- Red Hat JBoss EAP 8.0 for RHEL 8
- Red Hat JBoss EAP 8.0 for RHEL 9
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server
- Red Hat JBoss Enterprise Application Platform 7.4.24
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform 8.1.3
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat build of Apache Camel - HawtIO 4
Timeline
- 2026-10-02 Threatist record created from CVE-2025-9784
- 2026-10-03 Alias added: GHSA-95h4-w6j8-2rp8
- 2026-10-06 Fix available: rh-sso-7/[email protected] · CNA
- 2026-10-06 2 new references · CNA
- 2026-10-06 2 new references · GHSA-95h4-w6j8-2rp8
- 2026-10-06 Fix available: RHSA-2026:76134 · Red Hat
- 2026-10-06 Fix available: RHSA-2026:76132 · Red Hat
- 2026-10-06 Fix available: RHSA-2026:76129 · Red Hat
- 2026-10-06 Fix available: RHSA-2026:76130 · Red Hat
- 2026-10-06 Fix available: Middleware Containers for OpenShift, Red Hat Single Sign-On 7.6 for RHEL 8, Red Hat Single Sign-On 7.6 for RHEL 9 +1 · Red Hat
- 2026-10-06 Fix available: rh-sso7-keycloak@0:18.0.20-1.redhat_00001.1.el8sso, rh-sso7-keycloak@0:18.0.20-1.redhat_00001.1.el9sso · CNA
- 2026-10-06 2 new references · CNA
- 2026-10-06 Fix available: rh-sso7-keycloak@0:18.0.20-1.redhat_00001.1.el7sso · CNA
- 2026-10-06 1 new reference · CNA
- 2026-10-07 Fix available: RHSA-2026:76128 · Red Hat
- 2026-10-07 Fix available: Red Hat Single Sign-On 7.6 for RHEL 7 Server · Red Hat
- 2026-10-15 Fix available: io.undertow/[email protected] · CNA
- 2026-10-16 Fix available: Red Hat JBoss Enterprise Application Platform 8.1.3 · Red Hat
References
Advisory 20
- RHSA-2025:23143
- RHSA-2026:0383
- RHSA-2026:0384
- RHSA-2026:0386
- RHSA-2026:33371
- RHSA-2026:33372
- RHSA-2026:3889
- RHSA-2026:3891
- RHSA-2026:3892
- RHSA-2026:4915
- RHSA-2026:4916
- RHSA-2026:4917
- RHSA-2026:4924
- RHSA-2026:76128
- RHSA-2026:76129
- RHSA-2026:76130
- RHSA-2026:76132
- RHSA-2026:76134
- https://access.redhat.com/security/cve/CVE-2025-9784
- https://nvd.nist.gov/vuln/detail/CVE-2025-9784
Other 11
- RHBZ#2392306
- https://github.com/undertow-io/undertow/pull/1778
- https://github.com/undertow-io/undertow/releases/tag/2.2.38.Final
- https://issues.redhat.com/browse/UNDERTOW-2598
- https://kb.cert.org/vuls/id/767506
- https://github.com/undertow-io/undertow/pull/1805
- https://github.com/undertow-io/undertow/pull/1804
- https://github.com/undertow-io/undertow/pull/1803
- https://github.com/undertow-io/undertow/pull/1802
- https://www.kb.cert.org/vuls/id/767506
- https://github.com/undertow-io/undertow
More Red Hat Build Of Apache Camel For Spring Boot vulnerabilities
- TI-2026-22645 Undertow: undertow: request smuggling via inconsistent header parsing CVSS 3.1CRITICAL 9.1
- TI-2026-22646 Undertow: undertow: request smuggling via malformed http request headers CVSS 3.1CRITICAL 9.1
- TI-2026-22644 Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator CVSS 3.1CRITICAL 9.1
- TI-2024-07308 Undertow: improper state management in proxy protocol parsing causes information leakage CVSS 3.1HIGH 7.5
Sources
- CVE-2025-9784 · CVE Program
- CVE-2025-9784 · NVD
- FIRST EPSS
- GHSA-95h4-w6j8-2rp8 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-9784 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences