Server-side request forgery in undertow
Priority MEDIUM 40CWE-918Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 16 fixed, 10 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and in http/2. I would add it to any TLS client protocol.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00596 48th percentileScored 2026-11-07
Fix Partial io.undertow:undertow-core (Maven): 2.3.5.Final, 2.2.24.FinalRed Hat: 16 advisoriesRed Hat: 16 fixed, 10 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | undertow | 2.7 | — | No fix listed | CNA |
| — | io.undertow:undertow-core (Maven) | 2.3.0 to before 2.3.5.Final | 2.3.5.Final | Patch available | GHSA-pfcc-3g6r-8rg8 |
| — | io.undertow:undertow-core (Maven) | before 2.2.24.Final | 2.2.24.Final | Patch available | GHSA-pfcc-3g6r-8rg8 |
- undertow Vendor— Affected 2.7 Fixed in — No fix listed CNA
- io.undertow:undertow-core (Maven) Vendor— Affected 2.3.0 to before 2.3.5.Final Fixed in 2.3.5.Final Patch available GHSA-pfcc-3g6r-8rg8
- io.undertow:undertow-core (Maven) Vendor— Affected before 2.2.24.Final Fixed in 2.2.24.Final Patch available GHSA-pfcc-3g6r-8rg8
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:build_of_quarkus:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:integration_camel_for_spring_boot:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:integration_camel_k:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:integration_service_registry:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:* | 7.0.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:* | 7.0.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:migration_toolkit_for_applications:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:migration_toolkit_for_runtimes:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:undertow:2.7.0:*:*:*:*:*:*:* | 2.7.0 | Vulnerable | Red Hat |
- cpe:2.3:a:redhat:build_of_quarkus:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:integration_camel_for_spring_boot:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:integration_camel_k:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:integration_service_registry:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:migration_toolkit_for_applications:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:migration_toolkit_for_runtimes:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:undertow:2.7.0:*:*:*:*:*:*:* Versions 2.7.0 Vulnerable ·Red Hat
Remediation
- Fix · GHSA-pfcc-3g6r-8rg8 io.undertow:undertow-core (Maven) Fixed in 2.3.5.Final Advisory →
- Fix · GHSA-pfcc-3g6r-8rg8 io.undertow:undertow-core (Maven) Fixed in 2.2.24.Final Advisory →
Red Hat 16 advisories
- RHSA-2025:9582 Released 2025-06-25 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.1.11 on RHEL 7 security update
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-glassfish-el-3.0.1-4.b08_redhat_00005.1.ep7.el7, eap7-glassfish-el-impl-3.0.1-4.b08_redhat_00005.1.ep7.el7, eap7-hibernate-5.1.17-3.Final_redhat_00004.1.ep7.el7 +22
- RHSA-2025:9583 Released 2025-06-25 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.3.14 Security update
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-jackson-annotations-2.10.4-3.redhat_00006.1.el7eap, eap7-jackson-core-2.10.4-3.redhat_00006.1.el7eap, eap7-jackson-databind-2.10.4-5.redhat_00006.1.el7eap +40
- RHSA-2023:4983 Released 2023-09-05 · Red Hat rating ImportantRed Hat Process Automation Manager 7.13.4 security update
- RHPAM 7.13.4 async
Show 13 more Red Hat advisories
- RHSA-2023:4627 Released 2023-08-14 · Red Hat rating ImportantMigration Toolkit for Applications security and bug fix update
- MTA 6.2 for RHEL 8 mta/mta-hub-rhel9, mta/mta-operator-bundle, mta/mta-ui-rhel9 +1
- RHSA-2023:3954 Released 2023-06-29 · Red Hat rating CriticalRed Hat Fuse 7.12 release and security update
- Red Hat Fuse 7.12
- RHSA-2023:3813 Released 2023-06-27 · Red Hat rating ModerateMigration Toolkit for Runtimes security update
- Migration Toolkit for Runtimes 1 on RHEL 8 mtr/mtr-web-container-rhel8
- RHSA-2023:2710 Released 2023-05-10 · Red Hat rating ModerateRed Hat Single Sign-On 7.6.3 for OpenShift image security update
- Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8
- RHSA-2023:2713 Released 2023-05-10 · Red Hat rating ModerateRed Hat Single Sign-On 7.6.3 security update
- Red Hat Single Sign-On 7
- RHSA-2023:2706 Released 2023-05-10 · Red Hat rating ModerateRed Hat Single Sign-On 7.6.3 security update on RHEL 8
- Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak-18.0.7-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-18.0.7-1.redhat_00001.1.el8sso
- RHSA-2023:2707 Released 2023-05-10 · Red Hat rating ModerateRed Hat Single Sign-On 7.6.3 security update on RHEL 9
- Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak-18.0.7-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server-18.0.7-1.redhat_00001.1.el9sso
- RHSA-2023:2705 Released 2023-05-10 · Red Hat rating ModerateRed Hat Single Sign-On 7.6.3 security update on RHEL 7
- Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak-18.0.7-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server-18.0.7-1.redhat_00001.1.el7sso
- RHSA-2023:2100 Released 2023-05-03 · Red Hat rating ImportantRed Hat Integration Camel for Spring Boot 3.20.1 security update
- RHINT Camel-Springboot 3.20.1
- RHSA-2023:1516 Released 2023-03-29 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.10 security update
- Red Hat JBoss Enterprise Application Platform com.h2database.h2-1.4.197.redhat-00004.jar, io.netty.netty-codec-haproxy-4.1.86.Final-redhat-00001.jar, io.undertow.undertow-core-2.2.23.SP2-redhat-00001.jar +3
- RHSA-2023:1512 Released 2023-03-29 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 7 security update
- Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-activemq-artemis-native-1:1.0.2-3.redhat_00004.1.el7eap, eap7-apache-mime4j-0.8.9-1.redhat_00001.1.el7eap, eap7-artemis-native-1:1.0.2-4.redhat_00004.1.el7eap +47
- RHSA-2023:1513 Released 2023-03-29 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 8 security update
- Red Hat JBoss EAP 7.4 for RHEL 8 eap7-activemq-artemis-native-1:1.0.2-3.redhat_00004.1.el8eap, eap7-apache-mime4j-0.8.9-1.redhat_00001.1.el8eap, eap7-artemis-native-1:1.0.2-4.redhat_00004.1.el8eap +47
- RHSA-2023:1514 Released 2023-03-29 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 9 security update
- Red Hat JBoss EAP 7.4 for RHEL 9 eap7-activemq-artemis-native-1:1.0.2-3.redhat_00004.1.el9eap, eap7-apache-mime4j-0.8.9-1.redhat_00001.1.el9eap, eap7-artemis-native-1:1.0.2-4.redhat_00004.1.el9eap +47
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Data Grid 8 | Affected | No fix planned: Will not fix |
| Red Hat Decision Manager 7 | Affected | No fix planned: Out of support scope |
| Red Hat Integration Camel K 1 | Affected | No fix yet |
| Red Hat Integration Camel Quarkus 1 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat Process Automation 7 | Affected | No fix planned: Out of support scope |
| Red Hat build of Debezium 1 | Affected | No fix planned: Will not fix |
| Red Hat build of Quarkus | Affected | No fix yet |
| MTA 6.2 for RHEL 8 | Fixed | RHSA-2023:4627 |
| Middleware Containers for OpenShift | Fixed | RHSA-2023:2710 |
| Migration Toolkit for Runtimes 1 on RHEL 8 | Fixed | RHSA-2023:3813 |
| RHINT Camel-Springboot 3.20.1 | Fixed | RHSA-2023:2100 |
| RHPAM 7.13.4 async | Fixed | RHSA-2023:4983 |
| Red Hat Fuse 7.12 | Fixed | RHSA-2023:3954 |
| Red Hat JBoss EAP 7.4 for RHEL 7 Server | Fixed | RHSA-2023:1512 |
| Red Hat JBoss EAP 7.4 for RHEL 8 | Fixed | RHSA-2023:1513 |
| Red Hat JBoss EAP 7.4 for RHEL 9 | Fixed | RHSA-2023:1514 |
| Red Hat JBoss Enterprise Application Platform | Fixed | RHSA-2023:1516 |
| Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server | Fixed | RHSA-2025:9582 |
| Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server | Fixed | RHSA-2025:9583 |
| Red Hat Single Sign-On 7 | Fixed | RHSA-2023:2713 |
| Red Hat Single Sign-On 7.6 for RHEL 7 Server | Fixed | RHSA-2023:2705 |
| Red Hat Single Sign-On 7.6 for RHEL 8 | Fixed | RHSA-2023:2706 |
| Red Hat Single Sign-On 7.6 for RHEL 9 | Fixed | RHSA-2023:2707 |
Not affected: 8 products
- MTA 6.2 for RHEL 8
- Migration Toolkit for Runtimes 1 on RHEL 8
- Red Hat JBoss EAP 7.4 for RHEL 7 Server
- Red Hat JBoss EAP 7.4 for RHEL 8
- Red Hat JBoss EAP 7.4 for RHEL 9
- Red Hat JBoss Enterprise Application Platform
- Red Hat JBoss Fuse Service Works 6
- Red Hat build of Apicurio Registry 2
Timeline
- 2026-10-02 Threatist record created from CVE-2022-4492
- 2026-10-03 Alias added: GHSA-pfcc-3g6r-8rg8
References
Advisory 3
Other 9
- https://security.netapp.com/advisory/ntap-20230324-0002/
- https://github.com/undertow-io/undertow/pull/1447
- https://github.com/undertow-io/undertow/pull/1447/commits/e5071e52b72529a14d3ec436ae7102cea5d918c4
- https://github.com/undertow-io/undertow/pull/1457
- https://github.com/undertow-io/undertow/pull/1457/commits/a4d3b167126a803cc4f7fb740dd9a6ecabf59342
- https://github.com/undertow-io/undertow/blob/master/core/src/main/java/io/undertow/security/impl/ClientCertAuthenticationMechanism.java
- https://issues.redhat.com/browse/MTA-93
- https://issues.redhat.com/browse/UNDERTOW-2212
- https://security.netapp.com/advisory/ntap-20230324-0002
More Red Hat Build Of Quarkus vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2022-03763 Injection in quarkus CVSS 3.1CRITICAL 9.8
- TI-2023-05869 Quarkus: graphql operations over websockets bypass CVSS 3.1CRITICAL 9.1
- TI-2023-04469 Quarkus: http security policy bypass CVSS 3.1HIGH 8.1
- TI-2023-02786 Quarkus-core: tls protocol configured with quarkus.http.ssl.protocols is not enforced… CVSS 3.1HIGH 8.1
- TI-2023-01048 Undertow: infinite loop in sslconduit during close CVSS 3.1HIGH 7.5
Sources
- CVE-2022-4492 · CVE Program
- CVE-2022-4492 · NVD
- FIRST EPSS
- GHSA-pfcc-3g6r-8rg8 · GitHub Advisory Database · CC BY 4.0
- CVE-2022-4492 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences