CVE-2025-9784 is a vulnerability in Undertow HTTP server where malformed HTTP/2 client requests can trigger server-side stream resets repeatedly without incrementing abuse counters. This behavior, dubbed the "MadeYouReset" attack, allows attackers to cause excessive server workload and potential denial of service by exploiting a lack of resource allocation limits or throttling. The issue affects Red Hat build of Apache Camel for Spring Boot 4 and Red Hat JBoss Enterprise Application Platform 8. Red Hat has published multiple security advisories and released patched versions (e.g., Apache Camel 4.14.2 and JBoss EAP 8.1.3) that fix this vulnerability. The CVSS v3.1 base score is 7.5 (high severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and impact limited to availability (denial of service).

Successful exploitation of this vulnerability allows an unauthenticated remote attacker to induce excessive server workload by repeatedly causing server-side HTTP/2 stream aborts, leading to denial of service (DoS) conditions. There is no impact on confidentiality or integrity. No known exploits in the wild have been reported as of the latest advisories.

Red Hat has released official security updates that address CVE-2025-9784 in Red Hat build of Apache Camel 4.14.2 for Spring Boot and Red Hat JBoss Enterprise Application Platform 8.1.3. Users should apply these updates as soon as possible. Before applying the updates, ensure all previously released errata relevant to the system are applied and back up existing installations. No alternative mitigations or workarounds are specified in the vendor advisories. Patch status is confirmed as fixed by Red Hat.