Read the docs
TI-2018-00987 Aliases CVE-2018-1067GHSA-47mp-rq2x-wjf2

HTTP response splitting in [UNKNOWN] undertow

Priority LOW 31CWE-113Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 7 fixed, 5 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

In Undertow before versions 7.1.2.CR1, 7.1.2.GA it was found that the fix for CVE-2016-4993 was incomplete and Undertow web server is vulnerable to the injection of arbitrary HTTP headers, and also response splitting, due to insufficient sanitization and validation of user input before the input is used as part of an HTTP header value.

Why it matters now

EPSS 0.01785 78th percentileScored 2026-11-07
Fix Partial org.jboss.eap:wildfly-undertow (Maven): 7.1.2.GARed Hat: 7 advisoriesRed Hat: 7 fixed, 5 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
[UNKNOWN]undertowundertow 7.1.2.CR1; undertow 7.1.2.GA—No fix listedCNA
—org.jboss.eap:wildfly-undertow (Maven)before 7.1.2.GA7.1.2.GAPatch availableGHSA-47mp-rq2x-wjf2
  • undertow Vendor[UNKNOWN] Affected undertow 7.1.2.CR1; undertow 7.1.2.GA Fixed in — No fix listed CNA
  • org.jboss.eap:wildfly-undertow (Maven) Vendor— Affected before 7.1.2.GA Fixed in 7.1.2.GA Patch available GHSA-47mp-rq2x-wjf2

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*before 1.4.25; 2.0.0 to before 2.0.5VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1:*:*:*:*:*:*:*7.1VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*6.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0Running onRed Hat
cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*4.0VulnerableRed Hat
  • cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:* Versions before 1.4.25; 2.0.0 to before 2.0.5 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1:*:*:*:*:*:*:* Versions 7.1 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
  • cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-47mp-rq2x-wjf2 org.jboss.eap:wildfly-undertow (Maven) Fixed in 7.1.2.GA Advisory →

Red Hat 7 advisories

  • RHSA-2020:2562 Released 2020-06-15 · Red Hat rating Important
    EAP Continuous Delivery Technical Preview Release 13 security update
    • Red Hat JBoss Enterprise Application Platform Continuous Delivery
  • RHSA-2019:0877 Released 2019-04-24 · Red Hat rating Important
    Red Hat OpenShift Application Runtimes Thorntail 2.4.0 security & bug fix update
    • Text-Only RHOAR
  • RHSA-2018:2643 Released 2018-09-04 · Red Hat rating Important
    rhvm-appliance security update
    • Red Hat Virtualization 4 Hypervisor for RHEL 7 rhvm-appliance-2:4.2-20180828.0.el7
    • Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts rhvm-appliance-2:4.2-20180828.0.el7
Show 4 more Red Hat advisories
  • RHSA-2018:1251 Released 2018-04-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.2 security update
    • Red Hat JBoss EAP 7.1
  • RHSA-2018:1249 Released 2018-04-25 · Red Hat rating Important
    jboss-ec2-eap package for EAP 7.1.2
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server eap7-jboss-ec2-eap-7.1.2-1.GA_redhat_1.ep7.el6, eap7-jboss-ec2-eap-samples-7.1.2-1.GA_redhat_1.ep7.el6
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server eap7-jboss-ec2-eap-7.1.2-1.GA_redhat_1.ep7.el7, eap7-jboss-ec2-eap-samples-7.1.2-1.GA_redhat_1.ep7.el7
  • RHSA-2018:1247 Released 2018-04-25 · Red Hat rating Important
    JBoss Enterprise Application Platform 7.1.2 for RHEL 7
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server eap7-activemq-artemis-1.5.5.010-1.redhat_1.1.ep7.el7, eap7-activemq-artemis-cli-1.5.5.010-1.redhat_1.1.ep7.el7, eap7-activemq-artemis-commons-1.5.5.010-1.redhat_1.1.ep7.el7 +47
  • RHSA-2018:1248 Released 2018-04-25 · Red Hat rating Important
    JBoss Enterprise Application Platform 7.1.2 on RHEL 6
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server eap7-activemq-artemis-1.5.5.010-1.redhat_1.1.ep7.el6, eap7-activemq-artemis-cli-1.5.5.010-1.redhat_1.1.ep7.el6, eap7-activemq-artemis-commons-1.5.5.010-1.redhat_1.1.ep7.el6 +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss BRMS 5AffectedNo fix planned: Will not fix
Red Hat JBoss Fuse 6AffectedNo fix planned: Will not fix
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Will not fix
Red Hat JBoss SOA Platform 5AffectedNo fix planned: Will not fix
Red Hat OpenShift Application RuntimesAffectedNo fix yet
Red Hat JBoss EAP 7.1Fixed RHSA-2018:1251
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 ServerFixed RHSA-2018:1248, RHSA-2018:1249
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 ServerFixed RHSA-2018:1247, RHSA-2018:1249
Red Hat JBoss Enterprise Application Platform Continuous DeliveryFixed RHSA-2020:2562
Red Hat Virtualization 4 Hypervisor for RHEL 7Fixed RHSA-2018:2643
Red Hat Virtualization 4 Management Agent for RHEL 7 HostsFixed RHSA-2018:2643
Text-Only RHOARFixed RHSA-2019:0877
Not affected: 13 products
  • Red Hat Enterprise Linux 5
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat JBoss Data Grid 6
  • Red Hat JBoss Data Grid 7
  • Red Hat JBoss Enterprise Application Platform 5
  • Red Hat JBoss Enterprise Application Platform 6
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Web Server 2
  • Red Hat Single Sign-On 7
  • Red Hat Software Collections
  • Red Hat Virtualization 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-1067
  2. 2026-10-03 Alias added: GHSA-47mp-rq2x-wjf2

References

Advisory 8

  • TI-2017-08941 Deserialization of untrusted data in Red Hat jbossas KEVCVSS 3.1CRITICAL 9.8
  • TI-2010-01790 JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for… KEVCVSS 3.1HIGH 8.8
  • TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2010-01383 The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application… KEVCVSS 3.1HIGH 7.5
  • TI-2017-09354 XML external entity injection in Apache Solr before 7.1 with Apache Lucene before 7.1 CVSS 3.1CRITICAL 9.8
See all 243 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences