Security Bulletin: DevOps Test Performance contains a vulnerability related to use of the Undertow web server

Summary Due to use of the Undertow web server, DevOps Test Performance and Rational Performance Tester contain a potential Denial of Service DoS vulnerability. Vulnerability Details CVEID:CVE-2025-9784 DESCRIPTION: A flaw was found in Undertow where malformed client requests can trigger server-si...

RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.4.24 (RHSA-2026:4915)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:4915 advisory. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release o...

RHEL 8 : Red Hat JBoss Enterprise Application Platform 8.0.12 (RHSA-2026:3889)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:3889 advisory. Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime. This release o...

CVE-2025-9784 vulnerabilities

Vulnerabilities for packages: wildfly...

Linux Distros Unpatched Vulnerability : CVE-2025-9784

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as...

io.undertow:undertow-servlet (1.0.0.alpha17), io.undertow:undertow-websockets-jsr (1.0.0.alpha17) potentially affected by CVE-2025-9784 via io.undertow:undertow-core (1.0.0.alpha17)

io.undertow:undertow-core MAVEN version 1.0.0.alpha17 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.0.0.alpha17 - io.undertow:undertow-websockets-jsr 1.0.0.alpha17 Source...

com.github.zurekp:slb (0.0.5), fr.braindead:websocket-client (>=1.0.0, <=1.0.1) +25 more potentially affected by CVE-2025-9784 via io.undertow:undertow-core (1.2.0.beta8)

io.undertow:undertow-core MAVEN version 1.2.0.beta8 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.github.zurekp:slb 0.0.5 - fr.braindead:websocket-client =1.0.0, =1.0.4, =0.4.0, =0.4.0, =0.4.0,...

io.apiman:apiman-gateway-platforms-undertow (>=1.1.0.rc3, <=1.2.1.final), io.undertow.jastow:jastow (>=1.0.1.final, <=1.0.3.final) +3 more potentially affected by CVE-2025-9784 via io.undertow:undertow-core (1.0.1.final)

io.undertow:undertow-core MAVEN version 1.0.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.apiman:apiman-gateway-platforms-undertow =1.1.0.rc3, =1.0.1.final, =3.0.7.final, =3.0.12.final Sourc...

io.undertow:undertow-servlet (1.0.19.final), io.undertow:undertow-websockets-jsr (1.0.19.final) potentially affected by CVE-2025-9784 via io.undertow:undertow-core (1.0.19.final)

io.undertow:undertow-core MAVEN version 1.0.19.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.0.19.final - io.undertow:undertow-websockets-jsr 1.0.19.final Source...

ch.digitalfondue.stampo:stampo (1.0), ch.digitalfondue.stampo:stampo-maven-plugin (1.0) +37 more potentially affected by CVE-2025-9784 via io.undertow:undertow-core (1.2.4.final)

io.undertow:undertow-core MAVEN version 1.2.4.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - ch.digitalfondue.stampo:stampo 1.0 - ch.digitalfondue.stampo:stampo-maven-plugin 1.0 -...

africa.absa:inception-application (>=1.0.0, <=1.2.0), app.fmgp:scala-did-docs_3 (>=0.1.0-m16, <=0.1.0-m33) +2662 more potentially affected by CVE-2025-9784 via io.undertow:undertow-core (>=2.0.0.alpha1, <=2.2.37.final)

io.undertow:undertow-core MAVEN version =2.0.0.alpha1, =1.0.0, =0.1.0-m16, =1.0.0, =1.0.1, =1.0.2, =1.0.0, =1.2.1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.1 and more Source cves: CVE-2025-9784 Source advisory: GHSA-95H4-W6J8-2RP8...

com.github.avarabyeu.jashing.extensions:jashing-cvs (>=0.0.12, <=0.0.16), com.github.avarabyeu.jashing.extensions:jashing-git (>=0.0.12, <=0.0.16) +36 more potentially affected by CVE-2025-9784 via io.undertow:undertow-core (1.4.6.final)

io.undertow:undertow-core MAVEN version 1.4.6.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.github.avarabyeu.jashing.extensions:jashing-cvs =0.0.12, =0.0.12, =0.0.12, =0.0.12, =0.0.12, =0.4.3...

io.undertow:undertow-servlet (1.0.0.alpha3), io.undertow:undertow-websockets-jsr (1.0.0.alpha3) potentially affected by CVE-2025-9784 via io.undertow:undertow-core (1.0.0.alpha3)

io.undertow:undertow-core MAVEN version 1.0.0.alpha3 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.0.0.alpha3 - io.undertow:undertow-websockets-jsr 1.0.0.alpha3 Source...

io.undertow:undertow-http2-test-suite (1.2.0.beta9), io.undertow:undertow-servlet (1.2.0.beta9) +1 more potentially affected by CVE-2025-9784 via io.undertow:undertow-core (1.2.0.beta9)

io.undertow:undertow-core MAVEN version 1.2.0.beta9 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-http2-test-suite 1.2.0.beta9 - io.undertow:undertow-servlet 1.2.0.beta9 -...

io.undertow:undertow-servlet (1.0.0.alpha16), io.undertow:undertow-websockets-jsr (1.0.0.alpha16) potentially affected by CVE-2025-9784 via io.undertow:undertow-core (1.0.0.alpha16)

io.undertow:undertow-core MAVEN version 1.0.0.alpha16 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.0.0.alpha16 - io.undertow:undertow-websockets-jsr 1.0.0.alpha16 Source...

cn.dubby:itbus (>=0.2.7, <=0.2.8), com.github.gmcoringa:coordinator (0.0.2) +62 more potentially affected by CVE-2025-9784 via io.undertow:undertow-core (1.4.13.final)

io.undertow:undertow-core MAVEN version 1.4.13.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - cn.dubby:itbus =0.2.7, =0.7.0.release, =0.7.0.release, =1.5.1, =4.4.0-rc1, =4.4.0-rc1, =4.4.0-rc1,...

com.networknt:audit (>=1.4.1, <=1.4.6), com.networknt:balance (>=1.4.1, <=1.4.6) +48 more potentially affected by CVE-2025-9784 via io.undertow:undertow-core (1.4.19.final)

io.undertow:undertow-core MAVEN version 1.4.19.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.networknt:audit =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1,...

com.github.jmjlbmn:huiche-demo (>=1.0.1, <=1.0.5), com.github.jmjlbmn:huiche-spring-boot-starter (>=1.0.1, <=1.0.6) +124 more potentially affected by CVE-2025-9784 via io.undertow:undertow-core (1.4.22.final)

io.undertow:undertow-core MAVEN version 1.4.22.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.github.jmjlbmn:huiche-demo =1.0.1, =1.0.1, =1.0.1.release, =0.5.0, =1.5.8, =1.3.1, =4.10.0-beta2,...

com.baidubce.formula:launcher-spring-boot-starter (>=1.3.2.0, <=2.1.1.1), io.atlasmap:atlasmap-standalone (>=1.39.0, <=1.42.10) +62 more potentially affected by CVE-2025-9784 via io.undertow:undertow-core (1.4.26.final)

io.undertow:undertow-core MAVEN version 1.4.26.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.baidubce.formula:launcher-spring-boot-starter =1.3.2.0, =1.39.0, =0.10.0.release, =1.0.71.release,...

club.dawdler:dawdler-boot-web-undertow (>=0.0.1-jdk1.8-releases, <=0.1.6-jdk1.8-releases), club.dawdler:dawdler-boot-web-undertow-jsp (>=0.0.1-jdk1.8-releases, <=0.1.6-jdk1.8-releases) +53 more potentially affected by CVE-2025-9784 via io.undertow:undertow-core (1.4.28.final)

io.undertow:undertow-core MAVEN version 1.4.28.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - club.dawdler:dawdler-boot-web-undertow =0.0.1-jdk1.8-releases, =0.0.1-jdk1.8-releases,...