Bug#1117694: undertow: CVE-2025-9784

[Salvatore Bonaccorso]

Source: undertow
Version: 2.3.18-2
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for undertow.

CVE-2025-9784[0]:
| A flaw was found in Undertow where malformed client requests can
| trigger server-side stream resets without triggering abuse counters.
| This issue, referred to as the "MadeYouReset" attack, allows
| malicious clients to induce excessive server workload by repeatedly
| causing server-side stream aborts. While not a protocol bug, this
| highlights a common implementation weakness that can be exploited to
| cause a denial of service (DoS).


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-9784
    https://www.cve.org/CVERecord?id=CVE-2025-9784
[1] https://bugzilla.redhat.com/show_bug.cgi?id=2392306

Regards,
Salvatore