Read the docs
TI-2017-01912 Aliases CVE-2017-2666GHSA-mcfm-h73v-635m

It was discovered in Undertow that the code that parsed the HTTP request line permitted…

Priority LOW 34CWE-444Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 6 fixed, 1 without a fix

Attack profile from CVSS 3.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other than their own.

Why it matters now

EPSS 0.03095 87th percentileScored 2026-11-07
Fix Partial io.undertow:undertow-core (Maven): 1.3.31, 1.4.17Red Hat: 8 advisoriesRed Hat: 6 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
[UNKNOWN]undertowall versions—No fix listedCNA
—io.undertow:undertow-core (Maven)before 1.3.311.3.31Patch availableGHSA-mcfm-h73v-635m
—io.undertow:undertow-core (Maven)1.4.0 to before 1.4.171.4.17Patch availableGHSA-mcfm-h73v-635m
  • undertow Vendor[UNKNOWN] Affected all versions Fixed in — No fix listed CNA
  • io.undertow:undertow-core (Maven) Vendor— Affected before 1.3.31 Fixed in 1.3.31 Patch available GHSA-mcfm-h73v-635m
  • io.undertow:undertow-core (Maven) Vendor— Affected 1.4.0 to before 1.4.17 Fixed in 1.4.17 Patch available GHSA-mcfm-h73v-635m

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:redhat:undertow:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*7.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1.0:*:*:*:*:*:*:*7.1.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*6.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0Running onRed Hat
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
  • cpe:2.3:a:redhat:undertow:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1.0:*:*:*:*:*:*:* Versions 7.1.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian

Remediation

  • Fix · GHSA-mcfm-h73v-635m io.undertow:undertow-core (Maven) Fixed in 1.3.31 Advisory →
  • Fix · GHSA-mcfm-h73v-635m io.undertow:undertow-core (Maven) Fixed in 1.4.17 Advisory →

Red Hat 8 advisories

  • RHSA-2017:3458 Released 2017-12-13 · Red Hat rating Important
    eap7-jboss-ec2-eap security update
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server eap7-jboss-ec2-eap-7.1.0-5.GA_redhat_5.ep7.el6, eap7-jboss-ec2-eap-samples-7.1.0-5.GA_redhat_5.ep7.el6
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server eap7-jboss-ec2-eap-7.1.0-5.GA_redhat_5.ep7.el7, eap7-jboss-ec2-eap-samples-7.1.0-5.GA_redhat_5.ep7.el7
  • RHSA-2017:3455 Released 2017-12-13 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.0 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server eap7-activemq-artemis-1.5.5.008-1.redhat_1.1.ep7.el7, eap7-activemq-artemis-cli-1.5.5.008-1.redhat_1.1.ep7.el7, eap7-activemq-artemis-commons-1.5.5.008-1.redhat_1.1.ep7.el7 +47
  • RHSA-2017:3454 Released 2017-12-13 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.0 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server eap7-activemq-artemis-1.5.5.008-1.redhat_1.1.ep7.el6, eap7-activemq-artemis-cli-1.5.5.008-1.redhat_1.1.ep7.el6, eap7-activemq-artemis-commons-1.5.5.008-1.redhat_1.1.ep7.el6 +47
Show 5 more Red Hat advisories
  • RHSA-2017:3456 Released 2017-12-13 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.0 security update
    • Red Hat JBoss EAP 7.1
  • RHSA-2017:1412 Released 2017-06-07 · Red Hat rating Moderate
    eap7-jboss-ec2-eap security update
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server eap7-jboss-ec2-eap-7.0.6-1.GA_redhat_1.ep7.el6, eap7-jboss-ec2-eap-samples-7.0.6-1.GA_redhat_1.ep7.el6
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server eap7-jboss-ec2-eap-7.0.6-1.GA_redhat_1.ep7.el7, eap7-jboss-ec2-eap-samples-7.0.6-1.GA_redhat_1.ep7.el7
  • RHSA-2017:1410 Released 2017-06-07 · Red Hat rating Moderate
    JBoss Enterprise Application Platform 7.0.6 on Red Hat Enterprise Linux 6
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server eap7-activemq-artemis-1.1.0-17.SP20_redhat_1.1.ep7.el6, eap7-activemq-artemis-cli-1.1.0-17.SP20_redhat_1.1.ep7.el6, eap7-activemq-artemis-commons-1.1.0-17.SP20_redhat_1.1.ep7.el6 +47
  • RHSA-2017:1411 Released 2017-06-07 · Red Hat rating Moderate
    JBoss Enterprise Application Platform 7.0.6 on Red Hat Enterprise Linux 7
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server eap7-activemq-artemis-1.1.0-17.SP20_redhat_1.1.ep7.el7, eap7-activemq-artemis-cli-1.1.0-17.SP20_redhat_1.1.ep7.el7, eap7-activemq-artemis-commons-1.1.0-17.SP20_redhat_1.1.ep7.el7 +47
  • RHSA-2017:1409 Released 2017-06-07 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform security update
    • Red Hat JBoss EAP 7.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    [UNKNOWN] undertow — DSA-3906

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Fuse 6AffectedNo fix planned: Will not fix
Red Hat JBoss EAP 7.0Fixed RHSA-2017:1409
Red Hat JBoss EAP 7.1Fixed RHSA-2017:3456
Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 ServerFixed RHSA-2017:1410, RHSA-2017:1412
Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 ServerFixed RHSA-2017:1411, RHSA-2017:1412
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 ServerFixed RHSA-2017:3454, RHSA-2017:3458
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 ServerFixed RHSA-2017:3455, RHSA-2017:3458
Not affected: 1 product
  • Red Hat Single Sign-On 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-2666
  2. 2026-10-03 Alias added: GHSA-mcfm-h73v-635m
  3. 2026-11-06 Fix available: Red Hat JBoss EAP 7.0, Red Hat JBoss EAP 7.1 · Red Hat

References

Advisory 12

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences