https://bugzilla.redhat.com/show_bug.cgi?id=2392309
Bug ID: 2392309
Summary: [Minor Incident] CVE-2025-9784 resteasy: Undertow
MadeYouReset HTTP/2 DDoS Vulnerability [fedora-all]
Product: Fedora
Version: 42
Status: NEW
Whiteboard: {"flaws": ["1682c085-9e87-444f-bfdc-461cd9303fc6"]}
Component: resteasy
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: edewata(a)redhat.com
Reporter: jiahuja(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, cfu(a)redhat.com, dchen(a)redhat.com,
edewata(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jmagne(a)redhat.com, mfargett(a)redhat.com,
puntogil(a)libero.it
Blocks: 2392306 (CVE-2025-9784)
Target Milestone: ---
Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability
management information. If something is wrong or missing, please contact a
member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essent…
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2392306
[Bug 2392306] CVE-2025-9784 undertow: Undertow MadeYouReset HTTP/2 DDoS
Vulnerability
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2392309
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2389237
Bug ID: 2389237
Summary: CVE-2025-41242 resteasy: Spring Framework MVC path
traversal vulnerability [fedora-42]
Product: Fedora
Version: 42
Status: NEW
Whiteboard: {"flaws": ["f8195245-d684-4e4b-a716-c291e759c1e4"]}
Component: resteasy
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: edewata(a)redhat.com
Reporter: jmoroney(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, cfu(a)redhat.com, dchen(a)redhat.com,
edewata(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jmagne(a)redhat.com, mfargett(a)redhat.com,
puntogil(a)libero.it
Blocks: 2389113
Target Milestone: ---
Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability
management information. If something is wrong or missing, please contact a
member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essent…
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2389237
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2389233
Bug ID: 2389233
Summary: CVE-2025-9092 resteasy: Bouncycastle Resource
Exhaustion [fedora-42]
Product: Fedora
Version: 42
Status: NEW
Whiteboard: {"flaws": ["92a7d168-1807-4b9d-ad1d-821abf7684fb"]}
Component: resteasy
Keywords: Security, SecurityTracking
Severity: low
Priority: low
Assignee: edewata(a)redhat.com
Reporter: jmoroney(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, cfu(a)redhat.com, dchen(a)redhat.com,
edewata(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jmagne(a)redhat.com, mfargett(a)redhat.com,
puntogil(a)libero.it
Blocks: 2388912
Target Milestone: ---
Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability
management information. If something is wrong or missing, please contact a
member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essent…
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2389233
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2389228
Bug ID: 2389228
Summary: CVE-2025-9092 apache-commons-vfs: Bouncycastle
Resource Exhaustion [fedora-42]
Product: Fedora
Version: 42
Status: NEW
Whiteboard: {"flaws": ["92a7d168-1807-4b9d-ad1d-821abf7684fb"]}
Component: apache-commons-vfs
Keywords: Security, SecurityTracking
Severity: low
Priority: low
Assignee: gwync(a)protonmail.com
Reporter: jmoroney(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: epel-packagers-sig(a)lists.fedoraproject.org,
gwync(a)protonmail.com,
java-sig-commits(a)lists.fedoraproject.org,
michel(a)michel-slm.name, puntogil(a)libero.it
Blocks: 2388912
Target Milestone: ---
Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability
management information. If something is wrong or missing, please contact a
member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essent…
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2389228
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2388292
Bug ID: 2388292
Summary: CVE-2025-8916 resteasy: BouncyCastle denial of service
[fedora-42]
Product: Fedora
Version: 42
Status: NEW
Whiteboard: {"flaws": ["de52cbfa-b458-405d-bb3f-5aaf784d818a"]}
Component: resteasy
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: edewata(a)redhat.com
Reporter: jmoroney(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, cfu(a)redhat.com, dchen(a)redhat.com,
edewata(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jmagne(a)redhat.com, mfargett(a)redhat.com,
puntogil(a)libero.it
Blocks: 2388195
Target Milestone: ---
Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability
management information. If something is wrong or missing, please contact a
member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essent…
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2388292
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2388291
Bug ID: 2388291
Summary: CVE-2025-8916 resteasy: BouncyCastle denial of service
[fedora-42]
Product: Fedora
Version: 42
Status: NEW
Whiteboard: {"flaws": ["de52cbfa-b458-405d-bb3f-5aaf784d818a"]}
Component: resteasy
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: edewata(a)redhat.com
Reporter: jmoroney(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, cfu(a)redhat.com, dchen(a)redhat.com,
edewata(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jmagne(a)redhat.com, mfargett(a)redhat.com,
puntogil(a)libero.it
Blocks: 2388195
Target Milestone: ---
Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability
management information. If something is wrong or missing, please contact a
member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essent…
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2388291
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2388282
Bug ID: 2388282
Summary: CVE-2025-8916 apache-commons-vfs: BouncyCastle denial
of service [fedora-42]
Product: Fedora
Version: 42
Status: NEW
Whiteboard: {"flaws": ["de52cbfa-b458-405d-bb3f-5aaf784d818a"]}
Component: apache-commons-vfs
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: gwync(a)protonmail.com
Reporter: jmoroney(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: epel-packagers-sig(a)lists.fedoraproject.org,
gwync(a)protonmail.com,
java-sig-commits(a)lists.fedoraproject.org,
michel(a)michel-slm.name, puntogil(a)libero.it
Blocks: 2388195
Target Milestone: ---
Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability
management information. If something is wrong or missing, please contact a
member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essent…
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2388282
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2388033
Bug ID: 2388033
Summary: CVE-2025-8885 resteasy: Bouncy Castle denial of
service parsing ASN.1 Object Identifiers [fedora-42]
Product: Fedora
Version: 42
Status: NEW
Whiteboard: {"flaws": ["0b79a045-5fc5-4f81-9281-17861d5e821e"]}
Component: resteasy
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: edewata(a)redhat.com
Reporter: jmoroney(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: alee(a)redhat.com, cfu(a)redhat.com, dchen(a)redhat.com,
edewata(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jmagne(a)redhat.com, mfargett(a)redhat.com,
puntogil(a)libero.it
Blocks: 2387790
Target Milestone: ---
Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability
management information. If something is wrong or missing, please contact a
member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essent…
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2388033
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2388028
Bug ID: 2388028
Summary: CVE-2025-8885 apache-commons-vfs: Bouncy Castle denial
of service parsing ASN.1 Object Identifiers
[fedora-42]
Product: Fedora
Version: 42
Status: NEW
Whiteboard: {"flaws": ["0b79a045-5fc5-4f81-9281-17861d5e821e"]}
Component: apache-commons-vfs
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: gwync(a)protonmail.com
Reporter: jmoroney(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: epel-packagers-sig(a)lists.fedoraproject.org,
gwync(a)protonmail.com,
java-sig-commits(a)lists.fedoraproject.org,
michel(a)michel-slm.name, puntogil(a)libero.it
Blocks: 2387790
Target Milestone: ---
Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability
management information. If something is wrong or missing, please contact a
member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essent…
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2388028
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…