Version 2.3.18.Final

Undertow Core

No description available.

Install Instructions

mvn install undertow-core
Language Java

Find Undertow Core vulnerabilities in your supply chain.

Scan for Free

Undertow Core Vulnerabilities

Sort by
icon CVE (Latest)
  • icon CVE (Latest)
  • icon CVE (Oldest)
  • icon CVSS Score (Highest)
  • icon CVSS Score (Lowest)
CVE question mark icon CVSS Score question mark icon CWE(s) question mark icon EPSS Score question mark icon EPSS % question mark icon Impacted Versions
CVE-2016-4993 Medium 6.1 CWE-113, CWE-93 0.00315 0.70908
  • 2.0.0.Alpha1
  • 1.0.0.Alpha1–1.4.28.Final
CVE-2016-7046 Medium 5.9 CWE-399 0.03905 0.92224
  • 2.0.0.Alpha1
  • 1.0.0.Alpha1–1.4.28.Final
CVE-2017-12165 High 7.5 CWE-200, CWE-444 0.00466 0.76037
  • 2.0.0.Alpha1
  • 1.3.0.Final–1.4.16.Final
CVE-2017-12196 Medium 5.9 CWE-287, CWE-863 0.00284 0.69219
  • 2.0.0.Final–2.0.1.Final
  • 1.0.0.Alpha1–1.4.23.Final
CVE-2017-2666 Medium 6.5 CWE-200, CWE-444 0.00508 0.77067
  • 1.0.0.Alpha1–1.4.16.Final
CVE-2017-2670 High 7.5 CWE-835 0.02412 0.90227
  • 1.0.0.Alpha1–1.3.27.Final
CVE-2017-7559 Medium 6.1 CWE-200, CWE-444 0.00318 0.71022
  • 2.0.0.Alpha1
  • 1.3.0.Final–1.4.16.Final
CVE-2018-1048 High 7.5 CWE-116, CWE-22, CWE-20 0.00278 0.68841
  • 2.0.0.Alpha1
  • 1.0.0.Alpha1–1.4.28.Final
CVE-2018-1067 Medium 6.1 CWE-113 0.00206 0.59005
  • 2.0.0.Final–2.0.4.Final
  • 1.0.0.Alpha1–1.4.24.Final
CVE-2018-1114 Medium 6.5 CWE-400 0.00376 0.73373
  • 2.0.0.Alpha1–2.0.4.Final
  • 1.0.0.Alpha1–1.4.24.Final
CVE-2018-14642 Medium 5.3 CWE-200 0.00316 0.70964
  • 2.0.0.Final–2.0.14.Final
  • 1.0.0.Alpha1–1.4.26.Final
CVE-2019-10184 High 7.5 CWE-862 0.00535 0.77672
  • 2.0.0.Alpha1–2.0.22.Final
  • 1.0.0.Alpha1–1.4.28.Final
CVE-2019-10212 High 9.8 CWE-532 0.00398 0.7408
  • 2.0.0.Alpha1–2.0.19.Final
  • 1.0.0.Alpha1–1.4.28.Final
CVE-2019-14888 High 7.5 CWE-400 0.00184 0.56463
  • 2.0.0.Alpha1–2.0.28.Final
  • 1.0.0.Alpha1–1.4.28.Final
CVE-2019-3888 High 9.8 CWE-532 0.01808 0.8854
  • 2.0.0.Alpha1–2.0.20.Final
  • 1.0.0.Alpha1–1.4.28.Final
CVE-2020-10687 Medium 4.8 CWE-444, CWE-20 0.00102 0.42748
  • 2.0.0.Alpha1–2.1.8.Final
  • 1.0.0.Alpha1–1.4.28.Final
CVE-2020-10705 High 7.5 CWE-119, CWE-770 0.00098 0.41809
  • 2.0.0.Alpha1–2.1.0.Final
  • 1.0.0.Alpha1–1.4.28.Final
CVE-2020-10719 Medium 6.5 CWE-444 0.0009 0.39645
  • 2.0.0.Alpha1–2.1.0.Final
  • 1.0.0.Alpha1–1.4.28.Final
CVE-2020-1745 High 9.8 CWE-200, CWE-285 0.01008 0.84151
  • 2.0.0.Alpha1–2.0.29.Final
  • 1.0.0.Alpha1–1.4.28.Final
CVE-2020-1757 High 8.1 CWE-20 0.00063 0.2886
  • 2.0.0.Alpha1–2.0.42.Final
  • 1.0.0.Alpha1–1.4.28.Final
CVE-2020-27782 High 7.5 CWE-400 0.00087 0.3785
  • 2.0.0.Alpha1–2.1.4.Final
  • 1.0.0.Alpha1–1.4.28.Final
CVE-2021-20220 Medium 4.8 CWE-444 0.0009 0.39645
  • 2.0.0.Alpha1–2.1.5.Final
  • 1.0.0.Alpha1–1.4.28.Final
CVE-2021-3597 Medium 5.9 CWE-362 0.00091 0.40102
  • 2.0.0.Alpha1–2.2.8.Final
  • 1.0.0.Alpha1–1.4.28.Final
CVE-2021-3629 Medium 5.9 CWE-400 0.00091 0.40102
  • 2.0.0.Alpha1–2.2.10.Final
  • 1.0.0.Alpha1–1.4.28.Final
CVE-2021-3690 High 7.5 CWE-400, CWE-401 0.00125 0.48096
  • 2.0.0.Alpha1–2.2.9.Final
  • 1.0.0.Alpha1–1.4.28.Final
CVE-2021-3859 High 7.5 CWE-668, CWE-214 0.0059 0.78762
  • 2.0.0.Alpha1–2.2.14.Final
  • 1.0.0.Alpha1–1.4.28.Final
CVE-2022-2053 High 7.5 CWE-400 0.00084 0.36969
  • 2.0.0.Alpha1–2.3.0.Alpha1
  • 1.0.0.Alpha1–1.4.28.Final
CVE-2022-4492 High 7.5 CWE-295 0.00091 0.39788
  • 2.0.0.Alpha1–2.3.4.Final
  • 1.0.0.Alpha1–1.4.28.Final
CVE-2023-1108 High 7.5 CWE-835 0.00252 0.65567
  • 2.0.0.Alpha1–2.3.4.Final
  • 1.0.0.Alpha1–1.4.28.Final
CVE-2023-1973 High 7.5 CWE-20 0.00109 0.45015
  • 2.0.0.Alpha1–2.3.12.Final
  • 1.0.0.Alpha1–1.4.28.Final
CVE-2024-1459 Medium 5.3 CWE-24 0.00086 0.37496
  • 2.0.0.Alpha1–2.3.11.Final
  • 1.0.0.Alpha1–1.4.28.Final
CVE-2024-1635 High 7.5 CWE-400 0.00044 0.14182
  • 2.0.0.Alpha1–2.3.11.Final
  • 1.0.0.Alpha1–1.4.28.Final
CVE-2024-3653 Medium 5.3 CWE-401 0.00044 0.14182
  • 2.0.0.Alpha1–2.3.14.Final
  • 1.0.0.Alpha1–1.4.28.Final
CVE-2024-5971 High 7.5 CWE-674 0.00044 0.14182
  • 2.0.0.Alpha1–2.3.14.Final
  • 1.0.0.Alpha1–1.4.28.Final
CVE-2024-6162 High 7.5 CWE-400 0.00044 0.11331
  • 2.0.0.Alpha1–2.3.13.Final
  • 1.0.0.Alpha1–1.4.28.Final
CVE-2024-7885 High 7.5 CWE-362 0.00098 0.42065
  • 2.0.0.Alpha1–2.3.16.Final
  • 1.0.0.Alpha1–1.4.28.Final
CVE-2014-7816 Medium 5 CWE-22 0.04584 0.92763
  • 1.0.0.Alpha1–1.2.0.Beta2

Undertow Core Vulnerability Remediation Guidance

CVE Description Full list of Impacted Versions Fix
CVE-2024-7885 A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a result, different requests may share the same StringBuilder instance, potentially leading to information leakage between requests or responses. In some cases, a value from a previous request or response may be erroneously reused, which could lead to unintended data exposure. This issue primarily results in errors and connection termination but creates a risk of data leakage in multi-request environments. 1.3.11.Final, 1.3.24.Final, 2.0.0.Final, 1.3.13.Final, 1.1.0.CR8, 1.0.0.Beta17, 1.0.0.Beta5, 1.0.0.Alpha18 (Show all) Patch → 2.2.36.Final
CVE-2024-6162 A vulnerability was found in Undertow, where URL-encoded request paths can be mishandled during concurrent requests on the AJP listener. This issue arises because the same buffer is used to decode the paths for multiple requests simultaneously, leading to incorrect path information being processed. As a result, the server may attempt to access the wrong path, causing errors such as "404 Not Found" or other application failures. This flaw can potentially lead to a denial of service, as legitimate resources become inaccessible due to the path mix-up. 1.3.11.Final, 1.3.24.Final, 2.0.0.Final, 1.3.13.Final, 1.1.0.CR8, 1.0.0.Beta17, 1.0.0.Beta5, 1.0.0.Alpha18 (Show all) Patch → 2.2.36.Final
CVE-2024-5971 A vulnerability was found in Undertow, where the chunked response hangs after the body was flushed. The response headers and body were sent but the client would continue waiting as Undertow does not send the expected 0\r\n termination of the chunked response. This results in uncontrolled resource consumption, leaving the server side to a denial of service attack. This happens only with Java 17 TLSv1.3 scenarios. 1.3.11.Final, 1.3.24.Final, 2.0.0.Final, 1.3.13.Final, 1.1.0.CR8, 1.0.0.Beta17, 1.0.0.Beta5, 1.0.0.Alpha18 (Show all) Patch → 2.2.36.Final
CVE-2024-3653 A vulnerability was found in Undertow. This issue requires enabling the learning-push handler in the server's config, which is disabled by default, leaving the maxAge config in the handler unconfigured. The default is -1, which makes the handler vulnerable. If someone overwrites that config, the server is not subject to the attack. The attacker needs to be able to reach the server with a normal HTTP request. 1.3.11.Final, 1.3.24.Final, 2.0.0.Final, 1.3.13.Final, 1.1.0.CR8, 1.0.0.Beta17, 1.0.0.Beta5, 1.0.0.Alpha18 (Show all) Patch → 2.2.36.Final
CVE-2024-1635 A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and closes a connection with the HTTP port of the server and then closes the connection immediately, the server will end with both memory and open file limits exhausted at some point, depending on the amount of memory available. At HTTP upgrade to remoting, the WriteTimeoutStreamSinkConduit leaks connections if RemotingConnection is closed by Remoting ServerConnectionOpenListener. Because the remoting connection originates in Undertow as part of the HTTP upgrade, there is an external layer to the remoting connection. This connection is unaware of the outermost layer when closing the connection during the connection opening procedure. Hence, the Undertow WriteTimeoutStreamSinkConduit is not notified of the closed connection in this scenario. Because WriteTimeoutStreamSinkConduit creates a timeout task, the whole dependency tree leaks via that task, which is added to XNIO WorkerThread. So, the workerThread points to the Undertow conduit, which contains the connections and causes the leak. 1.3.11.Final, 1.3.24.Final, 2.0.0.Final, 1.3.13.Final, 1.1.0.CR8, 1.0.0.Beta17, 1.0.0.Beta5, 1.0.0.Alpha18 (Show all) Patch → 2.2.36.Final
CVE-2024-1459 A path traversal vulnerability was found in Undertow. This issue may allow a remote attacker to append a specially-crafted sequence to an HTTP request for an application deployed to JBoss EAP, which may permit access to privileged or restricted files and directories. 1.3.11.Final, 1.3.24.Final, 2.0.0.Final, 1.3.13.Final, 1.1.0.CR8, 1.0.0.Beta17, 1.0.0.Beta5, 1.0.0.Alpha18 (Show all) Patch → 2.2.36.Final
CVE-2023-1973 A flaw was found in Undertow package. Using the FormAuthenticationMechanism, a malicious user could trigger a Denial of Service by sending crafted requests, leading the server to an OutofMemory error, exhausting the server's memory. 1.3.11.Final, 1.3.24.Final, 2.0.0.Final, 1.3.13.Final, 1.1.0.CR8, 1.0.0.Beta17, 1.0.0.Beta5, 1.0.0.Alpha18 (Show all) Patch → 2.2.36.Final
CVE-2023-1108 A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates. 1.3.11.Final, 1.3.24.Final, 2.0.0.Final, 1.3.13.Final, 1.1.0.CR8, 1.0.0.Beta17, 1.0.0.Beta5, 1.0.0.Alpha18 (Show all) Patch → 2.2.36.Final
CVE-2022-4492 The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and in http/2. I would add it to any TLS client protocol. 1.3.11.Final, 1.3.24.Final, 2.0.0.Final, 1.3.13.Final, 1.1.0.CR8, 1.0.0.Beta17, 1.0.0.Beta5, 1.0.0.Alpha18 (Show all) Patch → 2.2.36.Final
CVE-2022-2053 When a POST request comes through AJP and the request exceeds the max-post-size limit (maxEntitySize), Undertow's AjpServerRequestConduit implementation closes a connection without sending any response to the client/proxy. This behavior results in that a front-end proxy marking the backend worker (application server) as an error state and not forward requests to the worker for a while. In mod_cluster, this continues until the next STATUS request (10 seconds intervals) from the application server updates the server state. So, in the worst case, it can result in "All workers are in error state" and mod_cluster responds "503 Service Unavailable" for a while (up to 10 seconds). In mod_proxy_balancer, it does not forward requests to the worker until the "retry" timeout passes. However, luckily, mod_proxy_balancer has "forcerecovery" setting (On by default; this parameter can force the immediate recovery of all workers without considering the retry parameter of the workers if all workers of a balancer are in error state.). So, unlike mod_cluster, mod_proxy_balancer does not result in responding "503 Service Unavailable". An attacker could use this behavior to send a malicious request and trigger server errors, resulting in DoS (denial of service). This flaw was fixed in Undertow 2.2.19.Final, Undertow 2.3.0.Alpha2. 1.3.11.Final, 1.3.24.Final, 2.0.0.Final, 1.3.13.Final, 1.1.0.CR8, 1.0.0.Beta17, 1.0.0.Beta5, 1.0.0.Alpha18 (Show all) Patch → 2.2.36.Final
CVE-2021-3859 A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. This flaw allows an attacker to carry out denial of service attacks. 1.3.11.Final, 1.3.24.Final, 2.0.0.Final, 1.3.13.Final, 1.1.0.CR8, 1.0.0.Beta17, 1.0.0.Beta5, 1.0.0.Alpha18 (Show all) Patch → 2.2.36.Final
CVE-2021-3690 A flaw was found in Undertow. A buffer leak on the incoming WebSocket PONG message may lead to memory exhaustion. This flaw allows an attacker to cause a denial of service. The highest threat from this vulnerability is availability. 1.3.11.Final, 1.3.24.Final, 2.0.0.Final, 1.3.13.Final, 1.1.0.CR8, 1.0.0.Beta17, 1.0.0.Beta5, 1.0.0.Alpha18 (Show all) Patch → 2.2.36.Final
CVE-2021-3629 A flaw was found in Undertow. A potential security issue in flow control handling by the browser over http/2 may potentially cause overhead or a denial of service in the server. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.40.Final and prior to 2.2.11.Final. 1.3.11.Final, 1.3.24.Final, 2.0.0.Final, 1.3.13.Final, 1.1.0.CR8, 1.0.0.Beta17, 1.0.0.Beta5, 1.0.0.Alpha18 (Show all) Patch → 2.2.36.Final
CVE-2021-3597 A flaw was found in undertow. The HTTP2SourceChannel fails to write the final frame under some circumstances, resulting in a denial of service. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.35.SP1, prior to 2.2.6.SP1, prior to 2.2.7.SP1, prior to 2.0.36.SP1, prior to 2.2.9.Final and prior to 2.0.39.Final. 1.3.11.Final, 1.3.24.Final, 2.0.0.Final, 1.3.13.Final, 1.1.0.CR8, 1.0.0.Beta17, 1.0.0.Beta5, 1.0.0.Alpha18 (Show all) Patch → 2.2.36.Final
CVE-2021-20220 A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from request other than their own. The highest threat from this vulnerability is to data confidentiality and integrity. 1.3.11.Final, 1.3.24.Final, 2.0.0.Final, 1.3.13.Final, 1.1.0.CR8, 1.0.0.Beta17, 1.0.0.Beta5, 1.0.0.Alpha18 (Show all) Patch → 2.2.36.Final
CVE-2020-27782 A flaw was found in the Undertow AJP connector. Malicious requests and abrupt connection closes could be triggered by an attacker using query strings with non-RFC compliant characters resulting in a denial of service. The highest threat from this vulnerability is to system availability. This affects Undertow 2.1.5.SP1, 2.0.33.SP2, and 2.2.3.SP1. 1.3.11.Final, 1.3.24.Final, 2.0.0.Final, 1.3.13.Final, 1.1.0.CR8, 1.0.0.Beta17, 1.0.0.Beta5, 1.0.0.Alpha18 (Show all) Patch → 2.2.36.Final
CVE-2020-1757 A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final, where the Servlet container causes servletPath to normalize incorrectly by truncating the path after semicolon which may lead to an application mapping resulting in the security bypass. 1.3.11.Final, 1.3.24.Final, 2.0.0.Final, 1.3.13.Final, 1.1.0.CR8, 1.0.0.Beta17, 1.0.0.Beta5, 1.0.0.Alpha18 (Show all) Patch → 2.2.36.Final
CVE-2020-1745 A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before and was fixed in 2.0.30.Final. A remote, unauthenticated attacker could exploit this vulnerability to read web application files from a vulnerable server. In instances where the vulnerable server allows file uploads, an attacker could upload malicious JavaServer Pages (JSP) code within a variety of file types and trigger this vulnerability to gain remote code execution. 1.3.11.Final, 1.3.24.Final, 2.0.0.Final, 1.3.13.Final, 1.1.0.CR8, 1.0.0.Beta17, 1.0.0.Beta5, 1.0.0.Alpha18 (Show all) Patch → 2.2.36.Final
CVE-2020-10719 A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes. This flaw allows an attacker to take advantage of HTTP request smuggling. 1.3.11.Final, 1.3.24.Final, 2.0.0.Final, 1.3.13.Final, 1.1.0.CR8, 1.0.0.Beta17, 1.0.0.Beta5, 1.0.0.Alpha18 (Show all) Patch → 2.2.36.Final
CVE-2020-10705 A flaw was discovered in Undertow in versions before Undertow 2.1.1.Final where certain requests to the "Expect: 100-continue" header may cause an out of memory error. This flaw may potentially lead to a denial of service. 1.3.11.Final, 1.3.24.Final, 2.0.0.Final, 1.3.13.Final, 1.1.0.CR8, 1.0.0.Beta17, 1.0.0.Beta5, 1.0.0.Alpha18 (Show all) Patch → 2.2.36.Final
CVE-2020-10687 A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from request other than their own. 1.3.11.Final, 1.3.24.Final, 2.0.0.Final, 1.3.13.Final, 1.1.0.CR8, 1.0.0.Beta17, 1.0.0.Beta5, 1.0.0.Alpha18 (Show all) Patch → 2.2.36.Final
CVE-2019-3888 A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUEST_LOGGER.undertowRequestFailed(t, exchange) 1.3.11.Final, 1.3.24.Final, 2.0.0.Final, 1.3.13.Final, 1.1.0.CR8, 1.0.0.Beta17, 1.0.0.Beta5, 1.0.0.Alpha18 (Show all) Patch → 2.2.36.Final
CVE-2019-14888 A vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS. An attacker can target the HTTPS port to carry out a Denial Of Service (DOS) to make the service unavailable on SSL. 1.3.11.Final, 1.3.24.Final, 2.0.0.Final, 1.3.13.Final, 1.1.0.CR8, 1.0.0.Beta17, 1.0.0.Beta5, 1.0.0.Alpha18 (Show all) Patch → 2.2.36.Final
CVE-2019-10212 A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user's credentials from the log files. 1.3.11.Final, 1.3.24.Final, 2.0.0.Final, 1.3.13.Final, 1.1.0.CR8, 1.0.0.Beta17, 1.0.0.Beta5, 1.0.0.Alpha18 (Show all) Patch → 2.2.36.Final
CVE-2019-10184 undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api. 1.3.11.Final, 1.3.24.Final, 2.0.0.Final, 1.3.13.Final, 1.1.0.CR8, 1.0.0.Beta17, 1.0.0.Beta5, 1.0.0.Alpha18 (Show all) Patch → 2.2.36.Final
CVE-2018-14642 An information leak vulnerability was found in Undertow. If all headers are not written out in the first write() call then the code that handles flushing the buffer will always write out the full contents of the writevBuffer buffer, which may contain data from previous requests. 1.3.11.Final, 1.3.24.Final, 2.0.0.Final, 1.3.13.Final, 1.1.0.CR8, 1.0.0.Beta17, 1.0.0.Beta5, 1.0.0.Alpha18 (Show all) Patch → 2.2.36.Final
CVE-2018-1114 It was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized which can cause file descriptors to exhaust. This leads to a file handler leak. 1.3.11.Final, 1.3.24.Final, 2.0.0.Final, 1.3.13.Final, 1.1.0.CR8, 1.0.0.Beta17, 1.0.0.Beta5, 1.0.0.Alpha18 (Show all) Patch → 2.2.36.Final
CVE-2018-1067 In Undertow before versions 7.1.2.CR1, 7.1.2.GA it was found that the fix for CVE-2016-4993 was incomplete and Undertow web server is vulnerable to the injection of arbitrary HTTP headers, and also response splitting, due to insufficient sanitization and validation of user input before the input is used as part of an HTTP header value. 1.3.11.Final, 1.3.24.Final, 2.0.0.Final, 1.3.13.Final, 1.1.0.CR8, 1.0.0.Beta17, 1.0.0.Beta5, 1.0.0.Alpha18 (Show all) Patch → 2.2.36.Final
CVE-2018-1048 It was found that the AJP connector in undertow, as shipped in Jboss EAP 7.1.0.GA, does not use the ALLOW_ENCODED_SLASH option and thus allow the the slash / anti-slash characters encoded in the url which may lead to path traversal and result in the information disclosure of arbitrary local files. 1.3.11.Final, 1.3.24.Final, 1.3.13.Final, 1.1.0.CR8, 1.0.0.Beta17, 1.0.0.Beta5, 1.0.0.Alpha18, 1.0.0.Alpha17 (Show all) Patch → 2.2.36.Final
CVE-2017-7559 In Undertow 2.x before 2.0.0.Alpha2, 1.4.x before 1.4.17.Final, and 1.3.x before 1.3.31.Final, it was found that the fix for CVE-2017-2666 was incomplete and invalid characters are still allowed in the query string and path parameters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other than their own. 1.3.11.Final, 1.3.24.Final, 1.3.13.Final, 2.0.0.Alpha1, 1.4.15.Final, 1.4.14.Final, 1.4.13.Final, 1.4.10.Final (Show all) Patch → 2.2.36.Final
CVE-2017-2670 It was found in Undertow before 1.3.28 that with non-clean TCP close, the Websocket server gets into infinite loop on every IO thread, effectively causing DoS. 1.3.11.Final, 1.3.24.Final, 1.3.13.Final, 1.1.0.CR8, 1.0.0.Beta17, 1.0.0.Beta5, 1.0.0.Alpha18, 1.0.0.Alpha17 (Show all) Patch → 2.2.36.Final
CVE-2017-2666 It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other than their own. 1.3.11.Final, 1.3.24.Final, 1.3.13.Final, 1.1.0.CR8, 1.0.0.Beta17, 1.0.0.Beta5, 1.0.0.Alpha18, 1.0.0.Alpha17 (Show all) Patch → 2.2.36.Final
CVE-2017-12196 undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker to cause a MITM attack and access the desired content on the server. 1.3.11.Final, 1.3.24.Final, 2.0.0.Final, 1.3.13.Final, 1.1.0.CR8, 1.0.0.Beta17, 1.0.0.Beta5, 1.0.0.Alpha18 (Show all) Patch → 2.2.36.Final
CVE-2017-12165 It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling. 1.3.11.Final, 1.3.24.Final, 1.3.13.Final, 2.0.0.Alpha1, 1.4.15.Final, 1.4.14.Final, 1.4.13.Final, 1.4.10.Final (Show all) Patch → 2.2.36.Final
CVE-2016-7046 Red Hat JBoss Enterprise Application Platform (EAP) 7, when operating as a reverse-proxy with default buffer sizes, allows remote attackers to cause a denial of service (CPU and disk consumption) via a long URL. 1.3.11.Final, 1.3.24.Final, 1.3.13.Final, 1.1.0.CR8, 1.0.0.Beta17, 1.0.0.Beta5, 1.0.0.Alpha18, 1.0.0.Alpha17 (Show all) Patch → 2.2.36.Final
CVE-2016-4993 CRLF injection vulnerability in the Undertow web server in WildFly 10.0.0, as used in Red Hat JBoss Enterprise Application Platform (EAP) 7.x before 7.0.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors. 1.3.11.Final, 1.3.24.Final, 1.3.13.Final, 1.1.0.CR8, 1.0.0.Beta17, 1.0.0.Beta5, 1.0.0.Alpha18, 1.0.0.Alpha17 (Show all) Patch → 2.2.36.Final
CVE-2014-7816 Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x before 1.1.0.CR5, and 1.2.x before 1.2.0.Beta3, when running on Windows, allows remote attackers to read arbitrary files via a .. (dot dot) in a resource URI. 1.1.0.CR8, 1.0.0.Beta17, 1.0.0.Beta5, 1.0.0.Alpha18, 1.0.0.Alpha17, 1.0.0.Alpha16, 1.0.0.Alpha7, 1.1.7.Final (Show all) Patch → 2.2.36.Final

Instantly see if these Undertow Core vulnerabilities affect your code.

Scan for Free

Dependencies

Packages using versions of Undertow Core affected by its vulnerabilities

Dependent Packages
io.undertow:undertow-parser-generator:
org.jboss.logging:jboss-logging:
org.jboss.logging:jboss-logging-processor:
org.jboss.xnio:xnio-api:
org.jboss.xnio:xnio-nio:
org.jboss.threads:jboss-threads:
io.netty:netty-all:
com.twitter:hpack:
junit:junit:
org.apache.directory.server:apacheds-test-framework:
org.apache.directory.server:apacheds-interceptor-kerberos:
org.apache.httpcomponents:httpclient:
org.apache.httpcomponents:httpmime:
org.easymock:easymock:
org.jboss.logmanager:jboss-logmanager:
com.h2database:h2:
org.wildfly.openssl:wildfly-openssl:${version.org.wildfly.openssl}