Read the docs
TI-2020-16867 Aliases CVE-2020-27782GHSA-rhcw-wjcm-9h6g

Uncontrolled resource consumption in Undertow

Priority LOW 36CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 11 fixed, 7 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

A flaw was found in the Undertow AJP connector. Malicious requests and abrupt connection closes could be triggered by an attacker using query strings with non-RFC compliant characters resulting in a denial of service. The highest threat from this vulnerability is to system availability. This affects Undertow 2.1.5.SP1, 2.0.33.SP2, and 2.2.3.SP1.

Why it matters now

EPSS 0.01375 72nd percentileScored 2026-11-07
Fix Partial io.undertow:undertow-core (Maven): 2.1.5, 2.0.33Red Hat: 11 advisoriesRed Hat: 11 fixed, 7 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Undertow2.1.5.SP1; 2.0.33.SP2; 2.2.3.SP1—No fix listedCNA
—io.undertow:undertow-core (Maven)2.1.0 to before 2.1.52.1.5Patch availableGHSA-rhcw-wjcm-9h6g
—io.undertow:undertow-core (Maven)before 2.0.332.0.33Patch availableGHSA-rhcw-wjcm-9h6g
  • Undertow Vendor— Affected 2.1.5.SP1; 2.0.33.SP2; 2.2.3.SP1 Fixed in — No fix listed CNA
  • io.undertow:undertow-core (Maven) Vendor— Affected 2.1.0 to before 2.1.5 Fixed in 2.1.5 Patch available GHSA-rhcw-wjcm-9h6g
  • io.undertow:undertow-core (Maven) Vendor— Affected before 2.0.33 Fixed in 2.0.33 Patch available GHSA-rhcw-wjcm-9h6g

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:redhat:jboss_fuse:6.0.0:*:*:*:*:*:*:*6.0.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:*7.0.0VulnerableRed Hat
cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:undertow:2.0.33:sp2:*:*:*:*:*:*2.0.33 sp2VulnerableRed Hat
cpe:2.3:a:redhat:undertow:2.1.5:sp1:*:*:*:*:*:*2.1.5 sp1VulnerableRed Hat
cpe:2.3:a:redhat:undertow:2.2.3:sp1:*:*:*:*:*:*2.2.3 sp1VulnerableRed Hat
  • cpe:2.3:a:redhat:jboss_fuse:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:undertow:2.0.33:sp2:*:*:*:*:*:* Versions 2.0.33 sp2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:undertow:2.1.5:sp1:*:*:*:*:*:* Versions 2.1.5 sp1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:undertow:2.2.3:sp1:*:*:*:*:*:* Versions 2.2.3 sp1 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-rhcw-wjcm-9h6g io.undertow:undertow-core (Maven) Fixed in 2.1.5 Advisory →
  • Fix · GHSA-rhcw-wjcm-9h6g io.undertow:undertow-core (Maven) Fixed in 2.0.33 Advisory →

Red Hat 11 advisories

  • RHSA-2025:9582 Released 2025-06-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.11 on RHEL 7 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-glassfish-el-3.0.1-4.b08_redhat_00005.1.ep7.el7, eap7-glassfish-el-impl-3.0.1-4.b08_redhat_00005.1.ep7.el7, eap7-hibernate-5.1.17-3.Final_redhat_00004.1.ep7.el7 +22
  • RHSA-2021:5134 Released 2021-12-14 · Red Hat rating Critical
    Red Hat Fuse 7.10.0 release and security update
    • Red Hat Fuse 7.10
  • RHSA-2021:3425 Released 2021-09-09 · Red Hat rating Important
    Red Hat support for Spring Boot 2.3.10 security update
    • Red Hat support for Spring Boot 2.3.10
Show 8 more Red Hat advisories
  • RHSA-2021:3207 Released 2021-08-18 · Red Hat rating Moderate
    Red Hat Integration Camel Quarkus Tech-Preview 2 security update
    • Red Hat Integration Camel Quarkus 2
  • RHSA-2021:3205 Released 2021-08-18 · Red Hat rating Moderate
    Red Hat Integration Camel-K 1.4 release and security update
    • Red Hat Integration
  • RHSA-2021:0295 Released 2021-02-08 · Red Hat rating Important
    Red Hat build of Thorntail 2.7.3 security and bug fix update
    • Text-Only RHOAR
  • RHSA-2021:0327 Released 2021-02-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.4.5 security update
    • Red Hat Single Sign-On 7.4.5
  • RHSA-2021:0248 Released 2021-01-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.5 security update
    • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-activemq-artemis-2.9.0-7.redhat_00017.1.el8eap, eap7-activemq-artemis-cli-2.9.0-7.redhat_00017.1.el8eap, eap7-activemq-artemis-commons-2.9.0-7.redhat_00017.1.el8eap +47
  • RHSA-2021:0247 Released 2021-01-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.5 security update
    • Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-activemq-artemis-2.9.0-7.redhat_00017.1.el7eap, eap7-activemq-artemis-cli-2.9.0-7.redhat_00017.1.el7eap, eap7-activemq-artemis-commons-2.9.0-7.redhat_00017.1.el7eap +47
  • RHSA-2021:0246 Released 2021-01-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.5 security update
    • Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-activemq-artemis-2.9.0-7.redhat_00017.1.el6eap, eap7-activemq-artemis-cli-2.9.0-7.redhat_00017.1.el6eap, eap7-activemq-artemis-commons-2.9.0-7.redhat_00017.1.el6eap +47
  • RHSA-2021:0250 Released 2021-01-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.5 security update
    • Red Hat JBoss Enterprise Application Platform 7

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Integration Camel K 1AffectedNo fix yet
Red Hat Integration Camel Quarkus 1AffectedNo fix yet
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix yet
Red Hat OpenShift Application RuntimesAffectedNo fix yet
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Will not fix
Red Hat support for Spring BootAffectedNo fix yet
Red Hat Fuse 7.10Fixed RHSA-2021:5134
Red Hat IntegrationFixed RHSA-2021:3205
Red Hat Integration Camel Quarkus 2Fixed RHSA-2021:3207
Red Hat JBoss EAP 7.3 for BaseOS-8Fixed RHSA-2021:0248
Red Hat JBoss EAP 7.3 for RHEL 6 ServerFixed RHSA-2021:0246
Red Hat JBoss EAP 7.3 for RHEL 7 ServerFixed RHSA-2021:0247
Red Hat JBoss Enterprise Application Platform 7Fixed RHSA-2021:0250
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 ServerFixed RHSA-2025:9582
Red Hat Single Sign-On 7.4.5Fixed RHSA-2021:0327
Red Hat support for Spring Boot 2.3.10Fixed RHSA-2021:3425
Text-Only RHOARFixed RHSA-2021:0295
Not affected: 4 products
  • Red Hat Decision Manager 7
  • Red Hat Integration Service Registry
  • Red Hat Process Automation 7
  • Red Hat build of Quarkus

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-27782
  2. 2026-10-03 Alias added: GHSA-rhcw-wjcm-9h6g

References

Advisory 2

Other 2

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2015-06239 Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data… CVSS 3.0CRITICAL 9.8
  • TI-2021-02983 Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2 CVSS 3.1HIGH 7.5
  • TI-2019-11096 Information disclosure in Red Hat jackson-databind CVSS 3.1CRITICAL 9.8
  • TI-2019-07493 XML external entity injection in Red Hat jackson-mapper-asl CVSS 3.1HIGH 7.5
  • TI-2014-00115 The admin terminal in Hawt.io does not require authentication, which allows remote… CVSS 3.0CRITICAL 9.8
See all 41 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences