Read the docs
TI-2020-08618 Aliases CVE-2020-10719GHSA-cccf-7xw3-p2vr

A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of…

Priority LOW 31CWE-444Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 12 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes. This flaw allows an attacker to take advantage of HTTP request smuggling.

Why it matters now

EPSS 0.01002 63rd percentileScored 2026-11-07
Fix Partial io.undertow:undertow-core (Maven): 2.1.1.FinalRed Hat: 12 advisoriesRed Hat: 12 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red Hatundertowbefore 2.1.1.Final2.1.1.FinalPatch availableCNA
—io.undertow:undertow-core (Maven)before 2.1.1.Final2.1.1.FinalPatch availableGHSA-cccf-7xw3-p2vr
  • undertow VendorRed Hat Affected before 2.1.1.Final Fixed in 2.1.1.Final Patch available CNA
  • io.undertow:undertow-core (Maven) Vendor— Affected before 2.1.1.Final Fixed in 2.1.1.Final Patch available GHSA-cccf-7xw3-p2vr

CPE configurations NVD · 16

CPEVersionsRoleVendor
cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*before 2.1.1VulnerableRed Hat
cpe:2.3:a:netapp:oncommand_insight:*:*:*:*:*:*:*:*before 7.3.13VulnerableNetApp
cpe:2.3:a:redhat:fuse:1.0:*:*:*:*:*:*:*1.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:text-only:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3:*:*:*:*:*:*:*7.3VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:*7.4VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0Running onRed Hat
  • cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:* Versions before 2.1.1 Vulnerable ·Red Hat
  • cpe:2.3:a:netapp:oncommand_insight:*:*:*:*:*:*:*:* Versions before 7.3.13 Vulnerable ·NetApp
  • cpe:2.3:a:redhat:fuse:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:text-only:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3:*:*:*:*:*:*:* Versions 7.3 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
Show 6 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*6.0Running onRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2:*:*:*:*:*:*:*7.2VulnerableRed Hat
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
  • cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Running on ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2:*:*:*:*:*:*:* Versions 7.2 Vulnerable ·Red Hat
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp

Remediation

  • Fix · GHSA-cccf-7xw3-p2vr io.undertow:undertow-core (Maven) Fixed in 2.1.1.Final Advisory →

Red Hat 12 advisories

  • RHSA-2021:3140 Released 2021-08-11 · Red Hat rating Moderate
    Red Hat Fuse 7.9.0 release and security update
    • Red Hat Fuse 7.9
  • RHSA-2020:3585 Released 2020-08-31 · Red Hat rating Important
    EAP Continuous Delivery Technical Preview Release 20 security update
    • EAP-CD 20 Tech Preview
  • RHSA-2020:2905 Released 2020-07-23 · Red Hat rating Important
    Red Hat build of Thorntail 2.7.0 security and bug fix update
    • Text-Only RHOAR
Show 9 more Red Hat advisories
  • RHSA-2020:2813 Released 2020-07-02 · Red Hat rating Important
    Red Hat Single Sign-On 7.4.1 security update
    • Red Hat Single Sign-On 7.4.1
  • RHSA-2020:2511 Released 2020-06-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.1 Security update
    • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-activemq-artemis-2.9.0-4.redhat_00010.1.el6eap, eap7-activemq-artemis-cli-2.9.0-4.redhat_00010.1.el6eap, eap7-activemq-artemis-commons-2.9.0-4.redhat_00010.1.el6eap +47
  • RHSA-2020:2512 Released 2020-06-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.1 Security update
    • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-activemq-artemis-2.9.0-4.redhat_00010.1.el7eap, eap7-activemq-artemis-cli-2.9.0-4.redhat_00010.1.el7eap, eap7-activemq-artemis-commons-2.9.0-4.redhat_00010.1.el7eap +47
  • RHSA-2020:2513 Released 2020-06-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.1 Security update
    • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-activemq-artemis-2.9.0-4.redhat_00010.1.el8eap, eap7-activemq-artemis-cli-2.9.0-4.redhat_00010.1.el8eap, eap7-activemq-artemis-commons-2.9.0-4.redhat_00010.1.el8eap +47
  • RHSA-2020:2515 Released 2020-06-10 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.1 Security update
    • Red Hat JBoss Enterprise Application Platform 7
  • RHSA-2020:2061 Released 2020-05-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.8 security update
    • Red Hat JBoss EAP 7.2
  • RHSA-2020:2060 Released 2020-05-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.8 on RHEL 8 security update
    • Red Hat JBoss EAP 7.2 for RHEL 8 eap7-activemq-artemis-2.9.0-4.redhat_00010.1.el8eap, eap7-activemq-artemis-cli-2.9.0-4.redhat_00010.1.el8eap, eap7-activemq-artemis-commons-2.9.0-4.redhat_00010.1.el8eap +47
  • RHSA-2020:2059 Released 2020-05-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.8 on RHEL 7 security update
    • Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-activemq-artemis-2.9.0-4.redhat_00010.1.el7eap, eap7-activemq-artemis-cli-2.9.0-4.redhat_00010.1.el7eap, eap7-activemq-artemis-commons-2.9.0-4.redhat_00010.1.el7eap +47
  • RHSA-2020:2058 Released 2020-05-11 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.8 on RHEL 6 security update
    • Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-activemq-artemis-2.9.0-4.redhat_00010.1.el6eap, eap7-activemq-artemis-cli-2.9.0-4.redhat_00010.1.el6eap, eap7-activemq-artemis-commons-2.9.0-4.redhat_00010.1.el6eap +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat OpenShift Application RuntimesAffectedNo fix yet
EAP-CD 20 Tech PreviewFixed RHSA-2020:3585
Red Hat Fuse 7.9Fixed RHSA-2021:3140
Red Hat JBoss EAP 7.2Fixed RHSA-2020:2061
Red Hat JBoss EAP 7.2 for RHEL 6 ServerFixed RHSA-2020:2058
Red Hat JBoss EAP 7.2 for RHEL 7 ServerFixed RHSA-2020:2059
Red Hat JBoss EAP 7.2 for RHEL 8Fixed RHSA-2020:2060
Red Hat JBoss EAP 7.3 for BaseOS-8Fixed RHSA-2020:2513
Red Hat JBoss EAP 7.3 for RHEL 6 ServerFixed RHSA-2020:2511
Red Hat JBoss EAP 7.3 for RHEL 7 ServerFixed RHSA-2020:2512
Red Hat JBoss Enterprise Application Platform 7Fixed RHSA-2020:2515
Red Hat Single Sign-On 7.4.1Fixed RHSA-2020:2813
Text-Only RHOARFixed RHSA-2020:2905
Not affected: 4 products
  • A-MQ Clients 2
  • Red Hat Data Grid 8
  • Red Hat Decision Manager 7
  • Red Hat Process Automation 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-10719
  2. 2026-10-03 Alias added: GHSA-cccf-7xw3-p2vr
  3. 2026-11-05 Fix available: Red Hat JBoss Enterprise Application Platform 7 · Red Hat

References

Advisory 3

Other 1

  • TI-2016-03813 Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember… KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-01295 The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows… KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2017-03645 Deserialization of untrusted data in Apache Log4j CVSS 3.1CRITICAL 9.8
  • TI-2018-01175 Code injection in Spring Framework CVSS 3.1CRITICAL 9.8
  • TI-2025-11507 Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf CVSS 3.1CRITICAL 9.6
See all 33 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences