[UNDERTOW-2598] CVE-2025-9784 Prevent a MadeYouReset HTTP2 attack by …

[fl4via]

…sending a go away in case too many rst streams were sent to the client.

Jira: https://issues.redhat.com/browse/UNDERTOW-2598

[usr42]

Is CVE-2025-9784 already fixed in version 2.3.19.Final like suggested in https://issues.redhat.com/browse/UNDERTOW-2598? Or does this PR needs to be merged first and a version 2.3.20.Final needs to be released to fix the CVE?

[marcosgopen]

Is CVE-2025-9784 already fixed in version 2.3.19.Final like suggested in https://issues.redhat.com/browse/UNDERTOW-2598? Or does this PR needs to be merged first and a version 2.3.20.Final needs to be released to fix the CVE?

I think this still needs to be fixed (the issue is code in progress).

[gdiazsnap]

Hi, is there any plan to release this fix soon?

[wolfkor]

We are also urgently waiting for a hotfix to resolve this high severity vulnerability

[lsainisnap]

We’re also eagerly awaiting a hotfix to fix this serious vulnerability. please merge and provide new fix version

[1kvsn]

Hey team, are we going to fix this soon ?

[eliasrahmanin26]

Hey team, any progress on this?

[fl4via]

Hello everyone! This fix has not passed all my tests and we have been working on finding the missing pieces. I am working on an updated version of this fix, one that contains those missing pieces.