Undertow: cookie smuggling/spoofing
Priority LOW 37CWE-444Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Partial Red Hat: 8 fixed, 11 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01093 65th percentileScored 2026-11-07
Fix Partial io.undertow:undertow-core (Maven): 2.3.11.Final, 2.2.30.FinalRed Hat: 7 advisoriesRed Hat: 8 fixed, 11 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | Migration Toolkit for Runtimes 1 on RHEL 8 | — | 1.2-23 | Patch available | CNA |
| Red Hat | Migration Toolkit for Runtimes 1 on RHEL 8 | — | 1.2-15 | Patch available | CNA |
| Red Hat | Migration Toolkit for Runtimes 1 on RHEL 8 | — | 1.2-16 | Patch available | CNA |
| Red Hat | Migration Toolkit for Runtimes 1 on RHEL 8 | — | 1.2-14 | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | — | — | Not affected | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 2.2.30-1.SP1_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 2.2.30-1.SP1_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | — | 2.2.30-1.SP1_redhat_00001.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | — | — | Not affected | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | — | 2.3.11-1.SP1_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | — | 2.3.11-1.SP1_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Migration Toolkit for Applications 6 | — | — | No fix listed | CNA |
| Red Hat | Red Hat build of Apache Camel for Spring Boot 3 | — | — | Not affected | CNA |
| Red Hat | Red Hat build of Apicurio Registry | — | — | No fix listed | CNA |
| Red Hat | Red Hat build of Quarkus | — | — | No fix listed | CNA |
| Red Hat | Red Hat Data Grid 8 | — | — | Not affected | CNA |
| Red Hat | Red Hat Decision Manager 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Fuse 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Integration Camel K | — | — | Not affected | CNA |
| Red Hat | Red Hat Integration Camel Quarkus | — | — | Not affected | CNA |
| Red Hat | Red Hat Integration Change Data Capture | — | — | No fix listed | CNA |
| Red Hat | Red Hat JBoss Data Grid 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 6 | — | — | No fix listed | CNA |
| Red Hat | Red Hat JBoss Fuse 6 | — | — | No fix listed | CNA |
| Red Hat | Red Hat JBoss Fuse Service Works 6 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Process Automation 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Single Sign-On 7 | — | — | No fix listed | CNA |
| — | io.undertow:undertow-core (Maven) | 2.3.0.Alpha1 to before 2.3.11.Final | 2.3.11.Final | Patch available | GHSA-3jrv-jgp8-45v3 |
| — | io.undertow:undertow-core (Maven) | before 2.2.30.Final | 2.2.30.Final | Patch available | GHSA-3jrv-jgp8-45v3 |
- Migration Toolkit for Runtimes 1 on RHEL 8 VendorRed Hat Affected — Fixed in 1.2-23 Patch available CNA
- Migration Toolkit for Runtimes 1 on RHEL 8 VendorRed Hat Affected — Fixed in 1.2-15 Patch available CNA
- Migration Toolkit for Runtimes 1 on RHEL 8 VendorRed Hat Affected — Fixed in 1.2-16 Patch available CNA
- Migration Toolkit for Runtimes 1 on RHEL 8 VendorRed Hat Affected — Fixed in 1.2-14 Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 2.2.30-1.SP1_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 2.2.30-1.SP1_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 VendorRed Hat Affected — Fixed in 2.2.30-1.SP1_redhat_00001.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 VendorRed Hat Affected — Fixed in 2.3.11-1.SP1_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 VendorRed Hat Affected — Fixed in 2.3.11-1.SP1_redhat_00001.1.el9eap Patch available CNA
- Migration Toolkit for Applications 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat build of Apache Camel for Spring Boot 3 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat build of Apicurio Registry VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat build of Quarkus VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Data Grid 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Decision Manager 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Fuse 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Integration Camel K VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Integration Camel Quarkus VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Integration Change Data Capture VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat JBoss Data Grid 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat JBoss Enterprise Application Platform 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat JBoss Fuse 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat JBoss Fuse Service Works 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Process Automation 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Single Sign-On 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- io.undertow:undertow-core (Maven) Vendor— Affected 2.3.0.Alpha1 to before 2.3.11.Final Fixed in 2.3.11.Final Patch available GHSA-3jrv-jgp8-45v3
- io.undertow:undertow-core (Maven) Vendor— Affected before 2.2.30.Final Fixed in 2.2.30.Final Patch available GHSA-3jrv-jgp8-45v3
CPE names CNA · 23
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:migration_toolkit_runtimes:1.0::el8 | 1.0 | — | Red Hat |
| cpe:/a:redhat:jboss_enterprise_application_platform:7.4 | 7.4 | — | Red Hat |
| cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8 | 7.4 | — | Red Hat |
| cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9 | 7.4 | — | Red Hat |
| cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7 | 7.4 | — | Red Hat |
| cpe:/a:redhat:jboss_enterprise_application_platform:8.0 | 8.0 | — | Red Hat |
| cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8 | 8.0 | — | Red Hat |
| cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9 | 8.0 | — | Red Hat |
| cpe:/a:redhat:migration_toolkit_applications:6 | 6 | — | Red Hat |
| cpe:/a:redhat:camel_spring_boot:3 | 3 | — | Red Hat |
- cpe:/a:redhat:migration_toolkit_runtimes:1.0::el8 Versions 1.0 — ·Red Hat
- cpe:/a:redhat:jboss_enterprise_application_platform:7.4 Versions 7.4 — ·Red Hat
- cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8 Versions 7.4 — ·Red Hat
- cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9 Versions 7.4 — ·Red Hat
- cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7 Versions 7.4 — ·Red Hat
- cpe:/a:redhat:jboss_enterprise_application_platform:8.0 Versions 8.0 — ·Red Hat
- cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8 Versions 8.0 — ·Red Hat
- cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9 Versions 8.0 — ·Red Hat
- cpe:/a:redhat:migration_toolkit_applications:6 Versions 6 — ·Red Hat
- cpe:/a:redhat:camel_spring_boot:3 Versions 3 — ·Red Hat
Show 13 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:service_registry:2 | 2 | — | Red Hat |
| cpe:/a:redhat:quarkus:2 | 2 | — | Red Hat |
| cpe:/a:redhat:jboss_data_grid:8 | 8 | — | Red Hat |
| cpe:/a:redhat:jboss_enterprise_brms_platform:7 | 7 | — | Red Hat |
| cpe:/a:redhat:jboss_fuse:7 | 7 | — | Red Hat |
| cpe:/a:redhat:integration:1 | 1 | — | Red Hat |
| cpe:/a:redhat:camel_quarkus:2 | 2 | — | Red Hat |
| cpe:/a:redhat:jboss_data_grid:7 | 7 | — | Red Hat |
| cpe:/a:redhat:jboss_enterprise_application_platform:6 | 6 | — | Red Hat |
| cpe:/a:redhat:jboss_fuse:6 | 6 | — | Red Hat |
| cpe:/a:redhat:jboss_fuse_service_works:6 | 6 | — | Red Hat |
| cpe:/a:redhat:jboss_enterprise_bpms_platform:7 | 7 | — | Red Hat |
| cpe:/a:redhat:red_hat_single_sign_on:7 | 7 | — | Red Hat |
- cpe:/a:redhat:service_registry:2 Versions 2 — ·Red Hat
- cpe:/a:redhat:quarkus:2 Versions 2 — ·Red Hat
- cpe:/a:redhat:jboss_data_grid:8 Versions 8 — ·Red Hat
- cpe:/a:redhat:jboss_enterprise_brms_platform:7 Versions 7 — ·Red Hat
- cpe:/a:redhat:jboss_fuse:7 Versions 7 — ·Red Hat
- cpe:/a:redhat:integration:1 Versions 1 — ·Red Hat
- cpe:/a:redhat:camel_quarkus:2 Versions 2 — ·Red Hat
- cpe:/a:redhat:jboss_data_grid:7 Versions 7 — ·Red Hat
- cpe:/a:redhat:jboss_enterprise_application_platform:6 Versions 6 — ·Red Hat
- cpe:/a:redhat:jboss_fuse:6 Versions 6 — ·Red Hat
- cpe:/a:redhat:jboss_fuse_service_works:6 Versions 6 — ·Red Hat
- cpe:/a:redhat:jboss_enterprise_bpms_platform:7 Versions 7 — ·Red Hat
- cpe:/a:redhat:red_hat_single_sign_on:7 Versions 7 — ·Red Hat
Remediation
- Fix · GHSA-3jrv-jgp8-45v3 io.undertow:undertow-core (Maven) Fixed in 2.3.11.Final Advisory →
- Fix · GHSA-3jrv-jgp8-45v3 io.undertow:undertow-core (Maven) Fixed in 2.2.30.Final Advisory →
Red Hat 7 advisories
- RHSA-2024:3919 Released 2024-06-13 · Red Hat rating ImportantMigration Toolkit for Runtimes security, bug fix and enhancement update
- Migration Toolkit for Runtimes 1 on RHEL 8 mtr/mtr-operator-bundle, mtr/mtr-rhel8-operator, mtr/mtr-web-container-rhel8 +1
- RHSA-2024:2764 Released 2024-05-08 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 8.0 security update
- Red Hat JBoss EAP 8.0 for RHEL 8 eap8-undertow-2.3.11-1.SP1_redhat_00001.1.el8eap
- Red Hat JBoss EAP 8.0 for RHEL 9 eap8-undertow-2.3.11-1.SP1_redhat_00001.1.el9eap
- RHSA-2024:2763 Released 2024-05-08 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 8.0 security update
- Red Hat JBoss Enterprise Application Platform 8
Show 4 more Red Hat advisories
- RHSA-2024:1674 Released 2024-04-04 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.16 Security update
- Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-activemq-artemis-2.16.0-18.redhat_00052.1.el7eap, eap7-activemq-artemis-cli-2.16.0-18.redhat_00052.1.el7eap, eap7-activemq-artemis-commons-2.16.0-18.redhat_00052.1.el7eap +47
- RHSA-2024:1675 Released 2024-04-04 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.16 Security update
- Red Hat JBoss EAP 7.4 for RHEL 8 eap7-activemq-artemis-2.16.0-18.redhat_00052.1.el8eap, eap7-activemq-artemis-cli-2.16.0-18.redhat_00052.1.el8eap, eap7-activemq-artemis-commons-2.16.0-18.redhat_00052.1.el8eap +47
- RHSA-2024:1676 Released 2024-04-04 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.16 Security update
- Red Hat JBoss EAP 7.4 for RHEL 9 eap7-activemq-artemis-2.16.0-18.redhat_00052.1.el9eap, eap7-activemq-artemis-cli-2.16.0-18.redhat_00052.1.el9eap, eap7-activemq-artemis-commons-2.16.0-18.redhat_00052.1.el9eap +47
- RHSA-2024:1677 Released 2024-04-04 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.16 Security update
- Red Hat JBoss Enterprise Application Platform 7.4.16 io.undertow.undertow-core-2.2.30.SP1-redhat-00001.jar, org.apache.sshd.sshd-common-2.12.1.redhat-00001.jar, org.jberet.jberet-core-1.3.9.SP3-redhat-00001.jar
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Decision Manager 7 | Affected | — |
| Red Hat Fuse 7 | Affected | — |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | — |
| Red Hat JBoss Fuse 6 | Affected | — |
| Red Hat JBoss Fuse Service Works 6 | Affected | — |
| Red Hat Process Automation 7 | Affected | — |
| Red Hat Single Sign-On 7 | Affected | — |
| Red Hat build of Apicurio Registry 2 | Affected | — |
| Red Hat build of Debezium 1 | Affected | — |
| Red Hat build of Quarkus | Affected | — |
| Migration Toolkit for Runtimes 1 on RHEL 8 | Fixed | RHSA-2024:3919 |
| Red Hat JBoss EAP 7.4 for RHEL 7 Server | Fixed | RHSA-2024:1674 |
| Red Hat JBoss EAP 7.4 for RHEL 8 | Fixed | RHSA-2024:1675 |
| Red Hat JBoss EAP 7.4 for RHEL 9 | Fixed | RHSA-2024:1676 |
| Red Hat JBoss EAP 8.0 for RHEL 8 | Fixed | RHSA-2024:2764 |
| Red Hat JBoss EAP 8.0 for RHEL 9 | Fixed | RHSA-2024:2764 |
| Red Hat JBoss Enterprise Application Platform 7.4.16 | Fixed | RHSA-2024:1677 |
| Red Hat JBoss Enterprise Application Platform 8 | Fixed | RHSA-2024:2763 |
Not affected: 9 products
- Migration Toolkit for Applications 6
- Red Hat Data Grid 8
- Red Hat Integration Camel K 1
- Red Hat Integration Camel Quarkus 1
- Red Hat JBoss EAP 7.4 for RHEL 7 Server
- Red Hat JBoss EAP 7.4 for RHEL 8
- Red Hat JBoss EAP 7.4 for RHEL 9
- Red Hat JBoss Enterprise Application Platform 7.4.16
- Red Hat build of Apache Camel for Spring Boot 3
Timeline
- 2026-10-02 Threatist record created from CVE-2023-4639
- 2026-10-03 Alias added: GHSA-3jrv-jgp8-45v3
- 2026-10-08 Fix available: Red Hat JBoss Enterprise Application Platform 7.4.16 · Red Hat
References
Advisory 8
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2023-4639 · CVE Program
- CVE-2023-4639 · NVD
- FIRST EPSS
- GHSA-3jrv-jgp8-45v3 · GitHub Advisory Database · CC BY 4.0
- CVE-2023-4639 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences