Read the docs
TI-2017-05200 Aliases CVE-2017-7559GHSA-rj76-h87p-r3wf

In Undertow 2.x before 2.0.0.Alpha2, 1.4.x before 1.4.17.Final, and 1.3.x before…

Priority LOW 31CWE-444Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 8 fixed, 1 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

In Undertow 2.x before 2.0.0.Alpha2, 1.4.x before 1.4.17.Final, and 1.3.x before 1.3.31.Final, it was found that the fix for CVE-2017-2666 was incomplete and invalid characters are still allowed in the query string and path parameters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other than their own.

Why it matters now

EPSS 0.01911 79th percentileScored 2026-11-07
Fix Partial io.undertow:undertow-core (Maven): 1.4.17.Final, 1.3.31.Final, 2.0.0.Alpha2Red Hat: 9 advisoriesRed Hat: 8 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red Hatundertow2 to before 2.0.0.Alpha2; 1.4 to before 1.4.17.Final; 1.3 to before 1.3.31.Final2.0.0.Alpha2, 1.4.17.Final, 1.3.31.FinalPatch availableCNA
—io.undertow:undertow-core (Maven)1.4.0 to before 1.4.17.Final1.4.17.FinalPatch availableGHSA-rj76-h87p-r3wf
—io.undertow:undertow-core (Maven)1.3.0 to before 1.3.31.Final1.3.31.FinalPatch availableGHSA-rj76-h87p-r3wf
—io.undertow:undertow-core (Maven)2.0.0.Alpha1 to before 2.0.0.Alpha22.0.0.Alpha2Patch availableGHSA-rj76-h87p-r3wf
  • undertow VendorRed Hat Affected 2 to before 2.0.0.Alpha2; 1.4 to before 1.4.17.Final; 1.3 to before 1.3.31.Final Fixed in 2.0.0.Alpha2, 1.4.17.Final, 1.3.31.Final Patch available CNA
  • io.undertow:undertow-core (Maven) Vendor— Affected 1.4.0 to before 1.4.17.Final Fixed in 1.4.17.Final Patch available GHSA-rj76-h87p-r3wf
  • io.undertow:undertow-core (Maven) Vendor— Affected 1.3.0 to before 1.3.31.Final Fixed in 1.3.31.Final Patch available GHSA-rj76-h87p-r3wf
  • io.undertow:undertow-core (Maven) Vendor— Affected 2.0.0.Alpha1 to before 2.0.0.Alpha2 Fixed in 2.0.0.Alpha2 Patch available GHSA-rj76-h87p-r3wf

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*1.3.0 to before 1.3.31; 1.4.0 to before 1.4.17VulnerableRed Hat
cpe:2.3:a:redhat:undertow:2.0.0:alpha1:*:*:*:*:*:*2.0.0 alpha1VulnerableRed Hat
  • cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:* Versions 1.3.0 to before 1.3.31; 1.4.0 to before 1.4.17 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:undertow:2.0.0:alpha1:*:*:*:*:*:* Versions 2.0.0 alpha1 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-rj76-h87p-r3wf io.undertow:undertow-core (Maven) Fixed in 1.4.17.Final Advisory →
  • Fix · GHSA-rj76-h87p-r3wf io.undertow:undertow-core (Maven) Fixed in 1.3.31.Final Advisory →
  • Fix · GHSA-rj76-h87p-r3wf io.undertow:undertow-core (Maven) Fixed in 2.0.0.Alpha2 Advisory →

Red Hat 9 advisories

  • RHSA-2018:1322 Released 2018-05-03 · Red Hat rating Moderate
    Red Hat JBoss Fuse/A-MQ 6.3 R7 security and bug fix update
    • Red Hat JBoss A-MQ 6.3
    • Red Hat JBoss Fuse 6.3
  • RHSA-2018:0005 Released 2018-01-03 · Red Hat rating Important
    eap7-jboss-ec2-eap security update
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server eap7-jboss-ec2-eap-7.0.9-2.GA_redhat_2.ep7.el6, eap7-jboss-ec2-eap-samples-7.0.9-2.GA_redhat_2.ep7.el6
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server eap7-jboss-ec2-eap-7.0.9-2.GA_redhat_2.ep7.el7, eap7-jboss-ec2-eap-samples-7.0.9-2.GA_redhat_2.ep7.el7
  • RHSA-2018:0004 Released 2018-01-03 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.0.9 security update on RHEL 7
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server eap7-activemq-artemis-1.1.0-19.SP24_redhat_1.1.ep7.el7, eap7-activemq-artemis-cli-1.1.0-19.SP24_redhat_1.1.ep7.el7, eap7-activemq-artemis-commons-1.1.0-19.SP24_redhat_1.1.ep7.el7 +47
Show 6 more Red Hat advisories
  • RHSA-2018:0002 Released 2018-01-03 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.0.9 security update on RHEL 6
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server eap7-activemq-artemis-1.1.0-19.SP24_redhat_1.1.ep7.el6, eap7-activemq-artemis-cli-1.1.0-19.SP24_redhat_1.1.ep7.el6, eap7-activemq-artemis-commons-1.1.0-19.SP24_redhat_1.1.ep7.el6 +47
  • RHSA-2018:0003 Released 2018-01-03 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.0.9 security update
    • Red Hat JBoss EAP 7.0
  • RHSA-2017:3458 Released 2017-12-13 · Red Hat rating Important
    eap7-jboss-ec2-eap security update
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server eap7-jboss-ec2-eap-7.1.0-5.GA_redhat_5.ep7.el6, eap7-jboss-ec2-eap-samples-7.1.0-5.GA_redhat_5.ep7.el6
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server eap7-jboss-ec2-eap-7.1.0-5.GA_redhat_5.ep7.el7, eap7-jboss-ec2-eap-samples-7.1.0-5.GA_redhat_5.ep7.el7
  • RHSA-2017:3455 Released 2017-12-13 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.0 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server eap7-activemq-artemis-1.5.5.008-1.redhat_1.1.ep7.el7, eap7-activemq-artemis-cli-1.5.5.008-1.redhat_1.1.ep7.el7, eap7-activemq-artemis-commons-1.5.5.008-1.redhat_1.1.ep7.el7 +47
  • RHSA-2017:3454 Released 2017-12-13 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.0 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server eap7-activemq-artemis-1.5.5.008-1.redhat_1.1.ep7.el6, eap7-activemq-artemis-cli-1.5.5.008-1.redhat_1.1.ep7.el6, eap7-activemq-artemis-commons-1.5.5.008-1.redhat_1.1.ep7.el6 +47
  • RHSA-2017:3456 Released 2017-12-13 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.0 security update
    • Red Hat JBoss EAP 7.1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss A-MQ 6.3Fixed RHSA-2018:1322
Red Hat JBoss EAP 7.0Fixed RHSA-2018:0003
Red Hat JBoss EAP 7.1Fixed RHSA-2017:3456
Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 ServerFixed RHSA-2018:0002, RHSA-2018:0005
Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 ServerFixed RHSA-2018:0004, RHSA-2018:0005
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 ServerFixed RHSA-2017:3454, RHSA-2017:3458
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 ServerFixed RHSA-2017:3455, RHSA-2017:3458
Red Hat JBoss Fuse 6.3Fixed RHSA-2018:1322
Not affected: 1 product
  • Red Hat Single Sign-On 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-7559
  2. 2026-10-03 Alias added: GHSA-rj76-h87p-r3wf
  3. 2026-11-06 Fix available: Red Hat JBoss EAP 7.0, Red Hat JBoss EAP 7.1 · Red Hat

References

Advisory 12

Other 1

  • TI-2025-11507 Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf CVSS 3.1CRITICAL 9.6
  • TI-2020-01688 Improper authorization in undertow-io undertow CVSS 3.1CRITICAL 9.8
  • TI-2019-02898 Sensitive information in log files in Red Hat undertow CVSS 3.1CRITICAL 9.8
  • TI-2019-07532 Sensitive information in log files in Red Hat undertow CVSS 3.1CRITICAL 9.8
  • TI-2023-03019 Undertow: outofmemoryerror due to @multipartconfig handling CVSS 3.1HIGH 7.5
  • TI-2014-06490 Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x before… CVSS 2.0MEDIUM 5.0
See all 38 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences