Read the docs
TI-2017-08955 Aliases CVE-2017-12165GHSA-5gg7-5wv8-4gcj

It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request…

Priority LOW 37CWE-444Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 8 fixed, 1 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling.

Why it matters now

EPSS 0.01858 79th percentileScored 2026-11-07
Fix Partial io.undertow:undertow-core (Maven): 1.3.31, 1.4.17, 2.0.0.Beta1Red Hat: 9 advisoriesRed Hat: 8 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red Hatundertow1.4.17; 1.3.31; 2.0.0—No fix listedCNA
—io.undertow:undertow-core (Maven)before 1.3.311.3.31Patch availableGHSA-5gg7-5wv8-4gcj
—io.undertow:undertow-core (Maven)1.4.0 to before 1.4.171.4.17Patch availableGHSA-5gg7-5wv8-4gcj
—io.undertow:undertow-core (Maven)2.0.0.Alpha1 to before 2.0.0.Beta12.0.0.Beta1Patch availableGHSA-5gg7-5wv8-4gcj
  • undertow VendorRed Hat Affected 1.4.17; 1.3.31; 2.0.0 Fixed in — No fix listed CNA
  • io.undertow:undertow-core (Maven) Vendor— Affected before 1.3.31 Fixed in 1.3.31 Patch available GHSA-5gg7-5wv8-4gcj
  • io.undertow:undertow-core (Maven) Vendor— Affected 1.4.0 to before 1.4.17 Fixed in 1.4.17 Patch available GHSA-5gg7-5wv8-4gcj
  • io.undertow:undertow-core (Maven) Vendor— Affected 2.0.0.Alpha1 to before 2.0.0.Beta1 Fixed in 2.0.0.Beta1 Patch available GHSA-5gg7-5wv8-4gcj

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*1.0.0 to before 1.3.31; 1.4.0 to before 1.4.17VulnerableRed Hat
cpe:2.3:a:redhat:undertow:2.0.0:alpha_1:*:*:*:*:*:*2.0.0 alpha_1VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*7.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1.0:*:*:*:*:*:*:*7.1.0VulnerableRed Hat
  • cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:* Versions 1.0.0 to before 1.3.31; 1.4.0 to before 1.4.17 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:undertow:2.0.0:alpha_1:*:*:*:*:*:* Versions 2.0.0 alpha_1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1.0:*:*:*:*:*:*:* Versions 7.1.0 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-5gg7-5wv8-4gcj io.undertow:undertow-core (Maven) Fixed in 1.3.31 Advisory →
  • Fix · GHSA-5gg7-5wv8-4gcj io.undertow:undertow-core (Maven) Fixed in 1.4.17 Advisory →
  • Fix · GHSA-5gg7-5wv8-4gcj io.undertow:undertow-core (Maven) Fixed in 2.0.0.Beta1 Advisory →

Red Hat 9 advisories

  • RHSA-2018:1322 Released 2018-05-03 · Red Hat rating Moderate
    Red Hat JBoss Fuse/A-MQ 6.3 R7 security and bug fix update
    • Red Hat JBoss A-MQ 6.3
    • Red Hat JBoss Fuse 6.3
  • RHSA-2018:0005 Released 2018-01-03 · Red Hat rating Important
    eap7-jboss-ec2-eap security update
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server eap7-jboss-ec2-eap-7.0.9-2.GA_redhat_2.ep7.el6, eap7-jboss-ec2-eap-samples-7.0.9-2.GA_redhat_2.ep7.el6
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server eap7-jboss-ec2-eap-7.0.9-2.GA_redhat_2.ep7.el7, eap7-jboss-ec2-eap-samples-7.0.9-2.GA_redhat_2.ep7.el7
  • RHSA-2018:0004 Released 2018-01-03 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.0.9 security update on RHEL 7
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server eap7-activemq-artemis-1.1.0-19.SP24_redhat_1.1.ep7.el7, eap7-activemq-artemis-cli-1.1.0-19.SP24_redhat_1.1.ep7.el7, eap7-activemq-artemis-commons-1.1.0-19.SP24_redhat_1.1.ep7.el7 +47
Show 6 more Red Hat advisories
  • RHSA-2018:0002 Released 2018-01-03 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.0.9 security update on RHEL 6
    • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server eap7-activemq-artemis-1.1.0-19.SP24_redhat_1.1.ep7.el6, eap7-activemq-artemis-cli-1.1.0-19.SP24_redhat_1.1.ep7.el6, eap7-activemq-artemis-commons-1.1.0-19.SP24_redhat_1.1.ep7.el6 +47
  • RHSA-2018:0003 Released 2018-01-03 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.0.9 security update
    • Red Hat JBoss EAP 7.0
  • RHSA-2017:3458 Released 2017-12-13 · Red Hat rating Important
    eap7-jboss-ec2-eap security update
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server eap7-jboss-ec2-eap-7.1.0-5.GA_redhat_5.ep7.el6, eap7-jboss-ec2-eap-samples-7.1.0-5.GA_redhat_5.ep7.el6
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server eap7-jboss-ec2-eap-7.1.0-5.GA_redhat_5.ep7.el7, eap7-jboss-ec2-eap-samples-7.1.0-5.GA_redhat_5.ep7.el7
  • RHSA-2017:3455 Released 2017-12-13 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.0 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server eap7-activemq-artemis-1.5.5.008-1.redhat_1.1.ep7.el7, eap7-activemq-artemis-cli-1.5.5.008-1.redhat_1.1.ep7.el7, eap7-activemq-artemis-commons-1.5.5.008-1.redhat_1.1.ep7.el7 +47
  • RHSA-2017:3454 Released 2017-12-13 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.0 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server eap7-activemq-artemis-1.5.5.008-1.redhat_1.1.ep7.el6, eap7-activemq-artemis-cli-1.5.5.008-1.redhat_1.1.ep7.el6, eap7-activemq-artemis-commons-1.5.5.008-1.redhat_1.1.ep7.el6 +47
  • RHSA-2017:3456 Released 2017-12-13 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.0 security update
    • Red Hat JBoss EAP 7.1

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Virtualization 4AffectedNo fix yet
Red Hat JBoss A-MQ 6.3Fixed RHSA-2018:1322
Red Hat JBoss EAP 7.0Fixed RHSA-2018:0003
Red Hat JBoss EAP 7.1Fixed RHSA-2017:3456
Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 ServerFixed RHSA-2018:0002, RHSA-2018:0005
Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 ServerFixed RHSA-2018:0004, RHSA-2018:0005
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 ServerFixed RHSA-2017:3454, RHSA-2017:3458
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 ServerFixed RHSA-2017:3455, RHSA-2017:3458
Red Hat JBoss Fuse 6.3Fixed RHSA-2018:1322
Not affected: 4 products
  • Red Hat Fuse 7
  • Red Hat JBoss Data Grid 7
  • Red Hat JBoss Fuse 6
  • Red Hat Single Sign-On 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-12165
  2. 2026-10-03 Alias added: GHSA-5gg7-5wv8-4gcj
  3. 2026-11-06 Fix available: Red Hat JBoss EAP 7.0, Red Hat JBoss EAP 7.1 · Red Hat

References

Advisory 11

Other 5

  • TI-2017-08941 Deserialization of untrusted data in Red Hat jbossas KEVCVSS 3.1CRITICAL 9.8
  • TI-2010-01790 JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for… KEVCVSS 3.1HIGH 8.8
  • TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2010-01383 The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application… KEVCVSS 3.1HIGH 7.5
  • TI-2017-09354 XML external entity injection in Apache Solr before 7.1 with Apache Lucene before 7.1 CVSS 3.1CRITICAL 9.8
See all 243 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences