Loading...

XML

Word

Printable

Type: Bug
Resolution: Done
Priority: Major
Fix Version/s: 2.2.38.Final, 2.3.20.Final
Affects Version/s: None
Component/s: None
Labels:
None

Git Pull Request:
https://github.com/undertow-io/undertow/pull/1778, https://github.com/undertow-io/undertow/pull/1802, https://github.com/undertow-io/undertow/pull/1804, https://github.com/undertow-io/undertow/pull/1803, https://github.com/undertow-io/undertow/pull/1805

HTTP/2 (including DNS over HTTPS) contains a design flaw and is vulnerable to "MadeYouReset" DoS attack through HTTP/2 control frames

is incorporated by

WFCORE-7375 Upgrade Undertow from 2.3.18.Final to 2.3.20.Final (resolves CVE-2024-4109, CVE-2025-9784)

Resolved

relates to

UNDERTOW-2628 Add a block list of malicious attackers per ip address

Open

WFLY-21028 Support a block list of malicious remote attackers

Open

UNDERTOW-2625 Connectors.isTokenCharacter throws ArrayIndexOutOfBounds

Open

UNDERTOW-2624 Http2FrameHeaderParser throws ClassCastException when parsing a push promise frame

Coding In Progress

UNDERTOW-2623 Http2DataStreamSinkChannel.generateSendFrameHeader can be invoked twice

Coding In Progress

(1 relates to)

Assignee:: Flavia Rainone

Reporter:: Flavia Rainone

Votes:: 0 Vote for this issue

Watchers:: 6 Start watching this issue

Created:: 2025/09/03 10:24 PM

Updated:: 2025/10/10 1:27 PM

Resolved:: 2025/10/10 1:25 PM