The vulnerability CVE-2025-9784 in Undertow involves the allocation of resources without limits or throttling when processing malformed client requests. These requests can trigger server-side HTTP/2 stream resets repeatedly without incrementing abuse counters, enabling malicious clients to cause excessive server workload and denial of service. This issue is categorized under CWE-404 (Improper Resource Shutdown or Release). The vulnerability has a CVSS v3.1 base score of 7.5 (High) with network attack vector, low attack complexity, no privileges or user interaction required, and impacts availability only. Red Hat has released official security advisories and patches for multiple products including Apache Camel 4.14.2 for Spring Boot and JBoss Enterprise Application Platform 8.1.3 for RHEL 8, which include fixes for this vulnerability.

Successful exploitation of this vulnerability can lead to denial of service by overwhelming the server with repeated stream aborts, causing excessive resource consumption and potential service disruption. There is no impact on confidentiality or integrity, only availability is affected. No known exploits in the wild have been reported at this time.

Official patches addressing CVE-2025-9784 have been released by Red Hat for affected products such as Apache Camel for Spring Boot 4.14.2 and JBoss Enterprise Application Platform 8.1.3 for RHEL 8. Users should apply these security updates promptly. Before applying updates, ensure all previous errata are applied and back up existing installations. Refer to Red Hat advisories (e.g., RHSA-2025:23143, RHSA-2026:0383) for detailed remediation instructions. Patch status is confirmed as official-fix.