Skip to content
Fencer Vulns
high 7.5

CVE-2025-9784 json

Undertow: undertow madeyoureset http/2 ddos vulnerability

published 2025-09-02 14 mo ago modified 2026-11-04 4 d ago also GHSA-95h4-w6j8-2rp8 , EUVD-2025-26388

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.3%
EPSS 2.3% chance of exploitation in 30 days, percentile 83%
public exploits
0
none known

Summary

A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).

Patch / fix

  • maven io.undertow:undertow-core 2.2.38.Final, 2.3.20.Final
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 0:1.4.18-21.SP19_redhat_00001.1.ep7.el7
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 0:2.0.41-8.SP9_redhat_00001.1.el7eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4.24 2.2.39.Final-redhat-00001
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 0:2.2.39-1.Final_redhat_00001.1.el7eap, 0:7.4.24-4.GA_redhat_00002.1.el7eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 0:2.2.39-1.Final_redhat_00001.1.el8eap, 0:7.4.24-4.GA_redhat_00002.1.el8eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 0:2.2.39-1.Final_redhat_00001.1.el9eap, 0:7.4.24-4.GA_redhat_00002.1.el9eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 0:1.0.0-3.redhat_00009.1.el8eap, 0:1.83.0-1.redhat_00001.1.el8eap, 0:2.0.2-1.Final_redhat_00001.1.el8eap, 0:2.3.23-1.SP3_redhat_00001.1.el8eap, 0:4.0.6-1.redhat_00001.1.el8eap, 0:33.0.0-2.jre_redhat_00003.1.el8eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 0:1.0.0-3.redhat_00009.1.el9eap, 0:1.83.0-1.redhat_00001.1.el9eap, 0:2.0.2-1.Final_redhat_00001.1.el9eap, 0:2.3.23-1.SP3_redhat_00001.1.el9eap, 0:4.0.6-1.redhat_00001.1.el9eap, 0:33.0.0-2.jre_redhat_00003.1.el9eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1.3 2.3.20.SP4-redhat-00001
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 0:1.0.1-3.redhat_00003.1.el8eap, 0:1.82.0-1.redhat_00001.1.el8eap, 0:2.3.20-2.SP4_redhat_00001.1.el8eap, 0:2.5.0-1.redhat_00001.1.el8eap, 0:2.6.6-1.Final_redhat_00001.1.el8eap, 0:4.0.2-1.Final_redhat_00001.1.el8eap, 0:4.0.10-1.redhat_00001.1.el8eap, 0:5.0.12-1.Final_redhat_00001.1.el8eap, 0:6.6.36-1.Final_redhat_00001.1.el8eap, 0:8.1.1-4.GA_redhat_00007.1.el8eap, 0:8.1.3-4.GA_redhat_00006.1.el8eap, 0:801.3.0-1.GA_redhat_00001.1.el8eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 0:1.0.1-3.redhat_00003.1.el9eap, 0:1.82.0-1.redhat_00001.1.el9eap, 0:2.3.20-2.SP4_redhat_00001.1.el9eap, 0:2.5.0-1.redhat_00001.1.el9eap, 0:2.6.6-1.Final_redhat_00001.1.el9eap, 0:4.0.2-1.Final_redhat_00001.1.el9eap, 0:4.0.10-1.redhat_00001.1.el9eap, 0:5.0.12-1.Final_redhat_00001.1.el9eap, 0:6.6.36-1.Final_redhat_00001.1.el9eap, 0:8.1.1-4.GA_redhat_00007.1.el9eap, 0:8.1.3-4.GA_redhat_00006.1.el9eap, 0:801.3.0-1.GA_redhat_00001.1.el9eap
  • Red Hat Red Hat Single Sign-On 7.6 for RHEL 7 0:18.0.20-1.redhat_00001.1.el7sso
  • Red Hat Red Hat Single Sign-On 7.6 for RHEL 8 0:18.0.20-1.redhat_00001.1.el8sso
  • Red Hat Red Hat Single Sign-On 7.6 for RHEL 9 0:18.0.20-1.redhat_00001.1.el9sso
  • Red Hat RHEL-8 based Middleware Containers 7.6-85
  • undertow Debian 14 2.3.20-1

debian advisories DEBIAN-CVE-2025-9784

  • rh-sso7-keycloak red hat single sign on 7.6 18.0.20-1.redhat_00001.1.el8sso
  • rh-sso7-keycloak-server red hat single sign on 7.6 18.0.20-1.redhat_00001.1.el8sso
  • rh-sso7-keycloak red hat single sign on 7.6 18.0.20-1.redhat_00001.1.el9sso
  • rh-sso7-keycloak-server red hat single sign on 7.6 18.0.20-1.redhat_00001.1.el9sso
  • rh-sso7-keycloak red hat single sign on 7.6 18.0.20-1.redhat_00001.1.el7sso
  • rh-sso7-keycloak-server red hat single sign on 7.6 18.0.20-1.redhat_00001.1.el7sso
  • eap8-jaxb jboss enterprise application platform 8.0 4.0.6-1.redhat_00001.1.el9eap
  • eap8-txw2 jboss enterprise application platform 8.0 4.0.6-1.redhat_00001.1.el9eap

red hat advisories RHSA-2026:76129RHSA-2026:76130RHSA-2026:76128RHSA-2026:33371RHSA-2026:33372RHSA-2026:4916

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-9784 updated cvss 7.5

undertow: Undertow MadeYouReset HTTP/2 DDoS Vulnerability

  • Red Hat Data Grid 8 undertow-core Red Hat Fuse 7 undertow-core
    affected: workaround, no fix planned “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.”
  • Red Hat JBoss Enterprise Application Platform 7 undertow-core Red Hat JBoss Enterprise Application Platform Expansion Pack org.jboss.eap-jboss-eap-xp
    affected: workaround, no fix available “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.”
  • Red Hat Process Automation 7 undertow-core
    affected: workaround, no fix planned “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.”
  • Red Hat Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8 7.6-85
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2026:76134
  • Red Hat build of Apache Camel 4.14.2 for Spring Boot 3.5.8
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2025:23143
  • Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server eap7-wildfly 7.4.24-4.GA_redhat_00002.1.el7eap, eap7-undertow 2.2.39-1.Final_redhat_00001.1.el7eap, eap7-wildfly-modules 7.4.24-4.GA_redhat_00002.1.el7eap, eap7-wildfly-javadocs 7.4.24-4.GA_redhat_00002.1.el7eap, eap7-wildfly-java-jdk8 7.4.24-4.GA_redhat_00002.1.el7eap, eap7-wildfly-java-jdk11 7.4.24-4.GA_redhat_00002.1.el7eap
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2026:4915
  • Red Hat JBoss EAP 7.4 ELS for RHEL 8 eap7-wildfly 7.4.24-4.GA_redhat_00002.1.el8eap, eap7-undertow 2.2.39-1.Final_redhat_00001.1.el8eap, eap7-wildfly-modules 7.4.24-4.GA_redhat_00002.1.el8eap, eap7-wildfly-javadocs 7.4.24-4.GA_redhat_00002.1.el8eap, eap7-wildfly-java-jdk8 7.4.24-4.GA_redhat_00002.1.el8eap, eap7-wildfly-java-jdk11 7.4.24-4.GA_redhat_00002.1.el8eap, +1 more
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2026:4916
  • Red Hat JBoss EAP 7.4 ELS for RHEL 9 eap7-wildfly 7.4.24-4.GA_redhat_00002.1.el9eap, eap7-undertow 2.2.39-1.Final_redhat_00001.1.el9eap, eap7-wildfly-modules 7.4.24-4.GA_redhat_00002.1.el9eap, eap7-wildfly-javadocs 7.4.24-4.GA_redhat_00002.1.el9eap, eap7-wildfly-java-jdk8 7.4.24-4.GA_redhat_00002.1.el9eap, eap7-wildfly-java-jdk11 7.4.24-4.GA_redhat_00002.1.el9eap, +1 more
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2026:4917
show 19 more
  • Red Hat JBoss EAP 8.0 for RHEL 8 eap8-jaxb 4.0.6-1.redhat_00001.1.el8eap, eap8-txw2 4.0.6-1.redhat_00001.1.el8eap, eap8-xsom 4.0.6-1.redhat_00001.1.el8eap, eap8-rngom 4.0.6-1.redhat_00001.1.el8eap, eap8-jaxb-jxc 4.0.6-1.redhat_00001.1.el8eap, eap8-jaxb-xjc 4.0.6-1.redhat_00001.1.el8eap, +15 more
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2026:3889
  • Red Hat JBoss EAP 8.0 for RHEL 9 eap8-jaxb 4.0.6-1.redhat_00001.1.el9eap, eap8-txw2 4.0.6-1.redhat_00001.1.el9eap, eap8-xsom 4.0.6-1.redhat_00001.1.el9eap, eap8-rngom 4.0.6-1.redhat_00001.1.el9eap, eap8-jaxb-jxc 4.0.6-1.redhat_00001.1.el9eap, eap8-jaxb-xjc 4.0.6-1.redhat_00001.1.el9eap, +15 more
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2026:3891
  • Red Hat JBoss EAP 8.1 for RHEL 8 eap8-wildfly 8.1.3-4.GA_redhat_00006.1.el8eap, eap8-apache-cxf 4.0.10-1.redhat_00001.1.el8eap, eap8-eventstream 1.0.1-3.redhat_00003.1.el8eap, eap8-bouncycastle 1.82.0-1.redhat_00001.1.el8eap, eap8-jboss-threads 2.5.0-1.redhat_00001.1.el8eap, eap8-undertow 2.3.20-2.SP4_redhat_00001.1.el8eap, +40 more
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2026:0383
  • Red Hat JBoss EAP 8.1 for RHEL 9 eap8-wildfly 8.1.3-4.GA_redhat_00006.1.el9eap, eap8-apache-cxf 4.0.10-1.redhat_00001.1.el9eap, eap8-eventstream 1.0.1-3.redhat_00003.1.el9eap, eap8-bouncycastle 1.82.0-1.redhat_00001.1.el9eap, eap8-jboss-threads 2.5.0-1.redhat_00001.1.el9eap, eap8-undertow 2.3.20-2.SP4_redhat_00001.1.el9eap, +40 more
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2026:0384
  • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-undertow 1.4.18-21.SP19_redhat_00001.1.ep7.el7
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2026:33372
  • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-undertow 2.0.41-8.SP9_redhat_00001.1.el7eap
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2026:33371
  • Red Hat JBoss Enterprise Application Platform 7.4.24 undertow-core 2.2.39.Final-redhat-00001
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2026:4924
  • Red Hat JBoss Enterprise Application Platform 8.0
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2026:3892
  • Red Hat JBoss Enterprise Application Platform 8.1.3 undertow-core 2.3.20.SP4-redhat-00001
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2026:0386
  • Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak 18.0.20-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server 18.0.20-1.redhat_00001.1.el7sso
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2026:76128
  • Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak 18.0.20-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server 18.0.20-1.redhat_00001.1.el8sso
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2026:76129
  • Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak 18.0.20-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server 18.0.20-1.redhat_00001.1.el9sso
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2026:76130
  • Red Hat Single Sign-On 7.6.13
    fixed: vendor fix “No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.” RHSA-2026:76132
  • Red Hat build of Apache Camel - HawtIO 4 undertow-core
    not affected: vulnerable code not in execute path
  • Red Hat Enterprise Linux 8 resteasy, resteasy-javadoc Red Hat Enterprise Linux 9 resteasy, pki-resteasy-core, pki-resteasy-client, pki-resteasy-jackson2-provider, pki-resteasy-servlet-initializer
    not affected: component not present
  • Red Hat Enterprise Linux 10 moditect
    not affected: vulnerable code not in execute path
  • Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server eap7-netty 4.1.124-1.Final_redhat_00001.1.el7eap, eap7-apache-cxf 3.5.11-1.SP1_redhat_00001.1.el7eap, eap7-hibernate 5.3.38-1.Final_redhat_00001.1.el7eap, eap7-resteasy 3.15.11-1.Final_redhat_00001.1.el7eap, eap7-elytron-web 1.9.6-2.Final_redhat_00001.1.el7eap, eap7-netty-all 4.1.124-1.Final_redhat_00001.1.el7eap, +74 more Red Hat JBoss EAP 7.4 ELS for RHEL 8 eap7-netty 4.1.124-1.Final_redhat_00001.1.el8eap, eap7-apache-cxf 3.5.11-1.SP1_redhat_00001.1.el8eap, eap7-hibernate 5.3.38-1.Final_redhat_00001.1.el8eap, eap7-resteasy 3.15.11-1.Final_redhat_00001.1.el8eap, eap7-elytron-web 1.9.6-2.Final_redhat_00001.1.el8eap, eap7-netty-all 4.1.124-1.Final_redhat_00001.1.el8eap, +74 more Red Hat JBoss EAP 7.4 ELS for RHEL 9 eap7-netty 4.1.124-1.Final_redhat_00001.1.el9eap, eap7-apache-cxf 3.5.11-1.SP1_redhat_00001.1.el9eap, eap7-hibernate 5.3.38-1.Final_redhat_00001.1.el9eap, eap7-resteasy 3.15.11-1.Final_redhat_00001.1.el9eap, eap7-elytron-web 1.9.6-2.Final_redhat_00001.1.el9eap, eap7-apache-cxf-rt 3.5.11-1.SP1_redhat_00001.1.el9eap, +71 more Red Hat JBoss EAP 8.0 for RHEL 8 eap8-gson 2.10.1-1.redhat_00005.1.el8eap, eap8-jose4j 0.9.6-2.redhat_00002.1.el8eap, eap8-yasson 3.0.4-2.redhat_00006.1.el8eap, eap8-javaewah 1.2.3-1.redhat_00002.1.el8eap, eap8-apache-cxf 4.0.10-2.redhat_00001.1.el8eap, eap8-wildfly 8.0.12-5.GA_redhat_00008.1.el8eap, +63 more Red Hat JBoss EAP 8.0 for RHEL 9 eap8-gson 2.10.1-1.redhat_00005.1.el9eap, eap8-jose4j 0.9.6-2.redhat_00002.1.el9eap, eap8-yasson 3.0.4-2.redhat_00006.1.el9eap, eap8-javaewah 1.2.3-1.redhat_00002.1.el9eap, eap8-apache-cxf 4.0.10-2.redhat_00001.1.el9eap, eap8-wildfly 8.0.12-5.GA_redhat_00008.1.el9eap, +63 more Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-apache-cxf 3.1.16-7.redhat_00007.1.ep7.el7, eap7-wildfly 7.1.15-3.GA_redhat_00002.1.ep7.el7, eap7-apache-cxf-rt 3.1.16-7.redhat_00007.1.ep7.el7, eap7-apache-cxf-tools 3.1.16-7.redhat_00007.1.ep7.el7, eap7-wildfly-modules 7.1.15-3.GA_redhat_00002.1.ep7.el7, eap7-apache-cxf-services 3.1.16-7.redhat_00007.1.ep7.el7
    +2 more products
    Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-wildfly 7.3.18-3.GA_redhat_00001.1.el7eap, eap7-apache-cxf 3.4.10-4.SP2_redhat_00004.1.el7eap, eap7-apache-cxf-rt 3.4.10-4.SP2_redhat_00004.1.el7eap, eap7-wildfly-modules 7.3.18-3.GA_redhat_00001.1.el7eap, eap7-wildfly-javadocs 7.3.18-3.GA_redhat_00001.1.el7eap, eap7-apache-cxf-tools 3.4.10-4.SP2_redhat_00004.1.el7eap, +25 more Red Hat JBoss Enterprise Application Platform 7.4.24 pom.xml, c3 0.6.0, c3 0.7.1, d3 5.9.2, fs 2.1.2, ip 2.0.0, +1552 more
    not affected: vulnerable code not present
  • Red Hat JBoss Enterprise Application Platform 8 org.jberet-jberet-parent, org.jboss.eap-jboss-eap-xp
    not affected: component not present
  • Red Hat JBoss Enterprise Application Platform 8.1.3 pom.xml, aesh 2.4, c3 0.6.4, d3 7.4.3, he 1.2.0, lr 1.4.2, +1858 more Red Hat JBoss Enterprise Application Platform Expansion Pack undertow-core
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
14 mo ago

Exploit prediction

2.33% chance of exploitation in the next 30 days, higher than 83% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
maven io.undertow:undertow-core
<2.2.38.Final
>=2.3.0.Alpha1, <2.3.20.Final
2.2.38.Final
2.3.20.Final

Affected products

  • Red Hat Red Hat build of Apache Camel 4.14.2 for Spring Boot 3.5.8
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4.24
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.0
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1.3
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
  • Red Hat Red Hat Single Sign-On 7.6.13
  • Red Hat Red Hat Single Sign-On 7.6 for RHEL 7
  • Red Hat Red Hat Single Sign-On 7.6 for RHEL 8
  • Red Hat Red Hat Single Sign-On 7.6 for RHEL 9
  • Red Hat RHEL-8 based Middleware Containers
  • Red Hat Red Hat build of Apache Camel - HawtIO 4
  • Red Hat Red Hat Data Grid 8
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Fuse 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 8
  • Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Red Hat Process Automation 7

Classification

Weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling
  • CWE-404 Improper Resource Shutdown or Release
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.