CVE-2025-9784: 
Java vulnerability analysis and mitigation

A critical vulnerability known as 'MadeYouReset' (CVE-2025-9784) was discovered in Undertow, affecting its HTTP/2 stream handling implementation. The vulnerability was disclosed on September 2, 2025, impacting various Red Hat products including JBoss Enterprise Application Platform, Data Grid, and Fuse (Red Hat CVE).

The vulnerability stems from an implementation weakness where malformed client requests can trigger server-side stream resets without activating abuse counters. The issue has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating network accessibility, low attack complexity, and no required privileges or user interaction (NVD). The vulnerability has been classified under CWE-404 (Improper Resource Shutdown or Release).

The vulnerability enables malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts, potentially leading to a denial of service (DoS) condition. While not a protocol bug, this implementation weakness can significantly impact server availability (NVD).

Red Hat has acknowledged the vulnerability and is tracking it through their bug tracking system (Bugzilla #2392306). Affected products include Red Hat JBoss Enterprise Application Platform 7 and 8, Red Hat Data Grid 8, and various other Red Hat products (Red Hat CVE).