Read the docs

Red Hat

Records7413All Threatist records
Exploited (KEV)98In CISA KEV
CVSS critical792CVSS 9.0–10.0
CVSS high2681CVSS 7.0–8.9

Exploited now

Red Hat records in CISA KEV
TI-2026-34021 Linux Kernel Missing Initialization of a Variable Vulnerability Priority CRITICAL 93KEV 2026-10-28TI-2015-04610 ISC BIND Data Processing Errors Vulnerability Priority CRITICAL 92KEV 2026-10-08TI-2026-35991 Kludex Starlette HTTP Request/Response Smuggling Vulnerability Priority CRITICAL 86KEV 2026-09-02TI-2015-02874 Red Hat Libuser Race Condition Vulnerability Priority CRITICAL 92KEV 2026-08-26TI-2015-04443 Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability Priority CRITICAL 93KEV 2026-08-26TI-2026-26741 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability Priority CRITICAL 90KEV 2026-08-04

Components

Products in the NVD configurations · select one to filter the records
Enterprise Linux 1956 records CRITICAL Enterprise Linux Desktop 1928 records CRITICAL Enterprise Linux Server 1891 records CRITICAL Enterprise Linux Workstation 1845 records CRITICAL Enterprise Linux Server Aus 1061 records CRITICAL Enterprise Linux Eus 796 records CRITICAL Enterprise Linux Server Tus 770 records CRITICAL Enterprise Linux Server Eus 622 records CRITICAL

Records

39 records in Undertow · all components

TI-2025-11507 CVE-2025-12543 · GHSA-j382-5jj3-vw4j

Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf

Priority HIGH 76

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.01333 Published 2026-01-07 Partial fix · 1.4.18-21.SP19_redhat_00001.1.ep7.el7, 2.0.41-8.SP9_redhat_00001.1.el7eap +50 CWE-20
TI-2020-01688 CVE-2020-1745 · GHSA-gv2w-88hx-8m9r

Improper authorization in undertow-io undertow

Priority MEDIUM 50

A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before and was fixed in 2.0.30.Final.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04957 Published 2020-04-28 Partial fix · 2.0.30 CWE-285
TI-2019-07532 CVE-2019-10212 · GHSA-8vh8-vc28-m2hf

Sensitive information in log files in Red Hat undertow

Priority MEDIUM 46

A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01892 Published 2019-10-02 Partial fix · 2.0.20 CWE-532
TI-2014-06490 CVE-2014-7816 · GHSA-h6p6-fc4w-cqhx

Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x before…

Priority MEDIUM 44

Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x before 1.1.0.CR5, and 1.2.x before 1.2.0.Beta3, when running on Windows, allows remote attackers to read arbitrary files via a ..

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.25082 Published 2014-12-01 Fixed in 1.0.17, 1.1.0.CR5 +1 CWE-22
TI-2025-08973 CVE-2025-9784 · GHSA-95h4-w6j8-2rp8

Undertow: undertow madeyoureset http/2 ddos vulnerability

Priority MEDIUM 43

A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02325 Published 2025-09-02 Partial fix · 2.2.38.Final, 1.4.18-21.SP19_redhat_00001.1.ep7.el7 +50 CWE-770
TI-2022-04106 CVE-2022-4492 · GHSA-pfcc-3g6r-8rg8

Server-side request forgery in undertow

Priority MEDIUM 40

The undertow client is not checking the server identity presented by the server certificate in https connections.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00596 Published 2023-02-23 Partial fix · 2.3.5.Final, 2.2.24.Final CWE-918
TI-2019-07505 CVE-2019-10184 · GHSA-w69w-jvc7-wjgv

Missing authorization in undertow-io undertow

Priority LOW 39

undertow before version 2.0.23.Final is vulnerable to an information leak issue.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03478 Published 2019-07-25 Partial fix · 2.0.23 CWE-862
TI-2017-01916 CVE-2017-2670 · GHSA-3x7h-5hfr-hvjm

Infinite loop in [UNKNOWN] undertow

Priority LOW 39

It was found in Undertow before 1.3.28 that with non-clean TCP close, the Websocket server gets into infinite loop on every IO thread, effectively causing DoS.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.03616 Published 2018-07-27 Partial fix · 1.3.28 CWE-835
TI-2020-01700 CVE-2020-1757 · GHSA-2w73-fqqj-c92p

Improper input validation in Red Hat undertow

Priority LOW 38

A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final, where the Servlet container causes servletPath to normalize…

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.01615 Published 2020-04-21 Partial fix · 2.1.0 CWE-20
TI-2019-11092 CVE-2019-14888 · GHSA-vjxc-frw4-jmh5

Uncontrolled resource consumption in Red Hat undertow

Priority LOW 37

A vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02179 Published 2020-01-23 Partial fix · 2.0.28.SP1, 2.0.29.Final CWE-400
TI-2022-01201 CVE-2022-1319 · GHSA-5r46-q4x7-6fx6

A flaw was found in Undertow.

Priority LOW 36

A flaw was found in Undertow.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01696 Published 2022-08-31 Partial fix CWE-252
TI-2021-02790 CVE-2021-3859 · GHSA-339q-62wm-c39w

Exposure of resource to wrong sphere in undertow

Priority LOW 36

A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01736 Published 2022-08-26 Partial fix · 2.2.15 CWE-214
TI-2020-16867 CVE-2020-27782 · GHSA-rhcw-wjcm-9h6g

Uncontrolled resource consumption in Undertow

Priority LOW 36

A flaw was found in the Undertow AJP connector.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01375 Published 2021-02-23 Partial fix · 2.1.5, 2.0.33 CWE-400
TI-2020-08606 CVE-2020-10705 · GHSA-g4cp-h53p-v3v8

Resource allocation without limits in Undertow

Priority LOW 36

A flaw was discovered in Undertow in versions before Undertow 2.1.1.Final where certain requests to the "Expect: 100-continue" header may cause an out of memory error.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01465 Published 2020-06-10 Partial fix · 2.1.1.Final CWE-770
TI-2019-13955 CVE-2019-19343 · GHSA-4v4m-hgv5-x3qx

Uncontrolled resource consumption in Undertow

Priority LOW 36

A flaw was found in Undertow when using Remoting as shipped in Red Hat Jboss EAP before version 7.2.4.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0163 Published 2021-03-23 Partial fix CWE-400
Load more
Open these records in search →