Undertow: directory traversal vulnerability
Priority LOW 27CWE-24Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Partial Red Hat: 6 fixed, 7 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
A path traversal vulnerability was found in Undertow. This issue may allow a remote attacker to append a specially-crafted sequence to an HTTP request for an application deployed to JBoss EAP, which may permit access to privileged or restricted files and directories.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01714 77th percentileScored 2026-11-07
Fix Partial undertow: 2.3.12io.undertow:undertow-core (Maven): 2.2.31.Final, 2.3.12.FinalRed Hat: 5 advisoriesRed Hat: 6 fixed, 7 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | undertow | before 2.3.12 | 2.3.12 | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 2.16.0-18.redhat_00052.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 3.4.10-2.redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 5.13.3.202401111512-1.r_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 1.9.4-1.Final_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 3.3.21-1.Final_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 5.3.36-1.Final_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 11.0.18-2.Final_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 1.1.2-1.redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 1.3.9-3.SP3_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 2.0.1-3.Final_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 1.1.2-1.redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 5.0.27-4.SP2_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 1.10.0-35.Final_redhat_00034.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 3.8.12-1.SP2_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 1.0.17-1.Final_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 5.5.5-6.redhat_2.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 2.2.30-1.SP1_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 7.4.16-4.GA_redhat_00002.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 1.15.22-1.Final_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 2.16.0-18.redhat_00052.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 3.4.10-2.redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 5.13.3.202401111512-1.r_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 1.9.4-1.Final_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 3.3.21-1.Final_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 5.3.36-1.Final_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 11.0.18-2.Final_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 1.1.2-1.redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 1.3.9-3.SP3_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 2.0.1-3.Final_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 1.1.2-1.redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 5.0.27-4.SP2_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 1.10.0-35.Final_redhat_00034.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 3.8.12-1.SP2_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 1.0.17-1.Final_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 5.5.5-6.redhat_2.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 2.2.30-1.SP1_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 7.4.16-4.GA_redhat_00002.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 1.15.22-1.Final_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | — | 2.16.0-18.redhat_00052.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | — | 3.4.10-2.redhat_00001.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | — | 5.13.3.202401111512-1.r_redhat_00001.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | — | 1.9.4-1.Final_redhat_00001.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | — | 3.3.21-1.Final_redhat_00001.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | — | 5.3.36-1.Final_redhat_00001.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | — | 11.0.18-2.Final_redhat_00001.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | — | 1.1.2-1.redhat_00001.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | — | 1.3.9-3.SP3_redhat_00001.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | — | 2.0.1-3.Final_redhat_00001.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | — | 1.1.2-1.redhat_00001.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | — | 5.0.27-4.SP2_redhat_00001.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | — | 1.10.0-35.Final_redhat_00034.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | — | 3.8.12-1.SP2_redhat_00001.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | — | 1.0.17-1.Final_redhat_00001.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | — | 5.5.5-6.redhat_2.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | — | 2.2.30-1.SP1_redhat_00001.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | — | 7.4.16-4.GA_redhat_00002.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | — | 1.15.22-1.Final_redhat_00001.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | — | — | Not affected | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | — | 2.3.11-1.SP1_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | — | 2.3.11-1.SP1_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat build of Quarkus | — | — | Not affected | CNA |
| Red Hat | Red Hat Data Grid 8 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Decision Manager 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Fuse 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat JBoss Data Grid 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat JBoss Fuse 6 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Process Automation 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Single Sign-On 7 | — | — | No fix listed | CNA |
| — | io.undertow:undertow-core (Maven) | before 2.2.31.Final | 2.2.31.Final | Patch available | GHSA-v76w-3ph8-vm66 |
| — | io.undertow:undertow-core (Maven) | 2.3.0.Alpha1 to before 2.3.12.Final | 2.3.12.Final | Patch available | GHSA-v76w-3ph8-vm66 |
- undertow Vendor— Affected before 2.3.12 Fixed in 2.3.12 Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 2.16.0-18.redhat_00052.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 3.4.10-2.redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 5.13.3.202401111512-1.r_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 1.9.4-1.Final_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 3.3.21-1.Final_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 5.3.36-1.Final_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 11.0.18-2.Final_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 1.1.2-1.redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 1.3.9-3.SP3_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 2.0.1-3.Final_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 1.1.2-1.redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 5.0.27-4.SP2_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 1.10.0-35.Final_redhat_00034.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 3.8.12-1.SP2_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 1.0.17-1.Final_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 5.5.5-6.redhat_2.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 2.2.30-1.SP1_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 7.4.16-4.GA_redhat_00002.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 1.15.22-1.Final_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 2.16.0-18.redhat_00052.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 3.4.10-2.redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 5.13.3.202401111512-1.r_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 1.9.4-1.Final_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 3.3.21-1.Final_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 5.3.36-1.Final_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 11.0.18-2.Final_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 1.1.2-1.redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 1.3.9-3.SP3_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 2.0.1-3.Final_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 1.1.2-1.redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 5.0.27-4.SP2_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 1.10.0-35.Final_redhat_00034.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 3.8.12-1.SP2_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 1.0.17-1.Final_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 5.5.5-6.redhat_2.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 2.2.30-1.SP1_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 7.4.16-4.GA_redhat_00002.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 1.15.22-1.Final_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 VendorRed Hat Affected — Fixed in 2.16.0-18.redhat_00052.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 VendorRed Hat Affected — Fixed in 3.4.10-2.redhat_00001.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 VendorRed Hat Affected — Fixed in 5.13.3.202401111512-1.r_redhat_00001.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 VendorRed Hat Affected — Fixed in 1.9.4-1.Final_redhat_00001.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 VendorRed Hat Affected — Fixed in 3.3.21-1.Final_redhat_00001.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 VendorRed Hat Affected — Fixed in 5.3.36-1.Final_redhat_00001.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 VendorRed Hat Affected — Fixed in 11.0.18-2.Final_redhat_00001.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 VendorRed Hat Affected — Fixed in 1.1.2-1.redhat_00001.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 VendorRed Hat Affected — Fixed in 1.3.9-3.SP3_redhat_00001.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 VendorRed Hat Affected — Fixed in 2.0.1-3.Final_redhat_00001.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 VendorRed Hat Affected — Fixed in 1.1.2-1.redhat_00001.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 VendorRed Hat Affected — Fixed in 5.0.27-4.SP2_redhat_00001.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 VendorRed Hat Affected — Fixed in 1.10.0-35.Final_redhat_00034.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 VendorRed Hat Affected — Fixed in 3.8.12-1.SP2_redhat_00001.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 VendorRed Hat Affected — Fixed in 1.0.17-1.Final_redhat_00001.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 VendorRed Hat Affected — Fixed in 5.5.5-6.redhat_2.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 VendorRed Hat Affected — Fixed in 2.2.30-1.SP1_redhat_00001.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 VendorRed Hat Affected — Fixed in 7.4.16-4.GA_redhat_00002.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 VendorRed Hat Affected — Fixed in 1.15.22-1.Final_redhat_00001.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 VendorRed Hat Affected — Fixed in 2.3.11-1.SP1_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 VendorRed Hat Affected — Fixed in 2.3.11-1.SP1_redhat_00001.1.el9eap Patch available CNA
- Red Hat build of Quarkus VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Data Grid 8 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Decision Manager 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Fuse 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat JBoss Data Grid 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat JBoss Fuse 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Process Automation 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Single Sign-On 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- io.undertow:undertow-core (Maven) Vendor— Affected before 2.2.31.Final Fixed in 2.2.31.Final Patch available GHSA-v76w-3ph8-vm66
- io.undertow:undertow-core (Maven) Vendor— Affected 2.3.0.Alpha1 to before 2.3.12.Final Fixed in 2.3.12.Final Patch available GHSA-v76w-3ph8-vm66
Remediation
- Fix · CNA undertow Fixed in 2.3.12
- Fix · GHSA-v76w-3ph8-vm66 io.undertow:undertow-core (Maven) Fixed in 2.2.31.Final Advisory →
- Fix · GHSA-v76w-3ph8-vm66 io.undertow:undertow-core (Maven) Fixed in 2.3.12.Final Advisory →
Red Hat 5 advisories
- RHSA-2024:2764 Released 2024-05-08 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 8.0 security update
- Red Hat JBoss EAP 8.0 for RHEL 8 eap8-undertow-2.3.11-1.SP1_redhat_00001.1.el8eap
- Red Hat JBoss EAP 8.0 for RHEL 9 eap8-undertow-2.3.11-1.SP1_redhat_00001.1.el9eap
- RHSA-2024:2763 Released 2024-05-08 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 8.0 security update
- Red Hat JBoss Enterprise Application Platform 8
- RHSA-2024:1674 Released 2024-04-04 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.16 Security update
- Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-activemq-artemis-2.16.0-18.redhat_00052.1.el7eap, eap7-activemq-artemis-cli-2.16.0-18.redhat_00052.1.el7eap, eap7-activemq-artemis-commons-2.16.0-18.redhat_00052.1.el7eap +47
Show 2 more Red Hat advisories
- RHSA-2024:1675 Released 2024-04-04 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.16 Security update
- Red Hat JBoss EAP 7.4 for RHEL 8 eap7-activemq-artemis-2.16.0-18.redhat_00052.1.el8eap, eap7-activemq-artemis-cli-2.16.0-18.redhat_00052.1.el8eap, eap7-activemq-artemis-commons-2.16.0-18.redhat_00052.1.el8eap +47
- RHSA-2024:1676 Released 2024-04-04 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.16 Security update
- Red Hat JBoss EAP 7.4 for RHEL 9 eap7-activemq-artemis-2.16.0-18.redhat_00052.1.el9eap, eap7-activemq-artemis-cli-2.16.0-18.redhat_00052.1.el9eap, eap7-activemq-artemis-commons-2.16.0-18.redhat_00052.1.el9eap +47
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Data Grid 8 | Affected | No fix planned: Will not fix |
| Red Hat Decision Manager 7 | Affected | No fix planned: Out of support scope |
| Red Hat Fuse 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat Process Automation 7 | Affected | No fix planned: Out of support scope |
| Red Hat Single Sign-On 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss EAP 7.4 for RHEL 7 Server | Fixed | RHSA-2024:1674 |
| Red Hat JBoss EAP 7.4 for RHEL 8 | Fixed | RHSA-2024:1675 |
| Red Hat JBoss EAP 7.4 for RHEL 9 | Fixed | RHSA-2024:1676 |
| Red Hat JBoss EAP 8.0 for RHEL 8 | Fixed | RHSA-2024:2764 |
| Red Hat JBoss EAP 8.0 for RHEL 9 | Fixed | RHSA-2024:2764 |
| Red Hat JBoss Enterprise Application Platform 8 | Fixed | RHSA-2024:2763 |
Not affected: 1 product
- Red Hat build of Quarkus
Timeline
- 2026-10-02 Threatist record created from CVE-2024-1459
- 2026-10-03 Alias added: GHSA-v76w-3ph8-vm66
References
Advisory 7
Other 7
- RHBZ#2259475
- https://github.com/undertow-io/undertow/pull/1556
- https://github.com/undertow-io/undertow/commit/40bb3314f013247af8e222870bd5045ca8650c5c
- https://github.com/undertow-io/undertow/commit/54f3e4325425c472f5af5fc973e02df83d7a711a
- https://access.redhat.com/errata/RHSA-2024:1677
- https://issues.redhat.com/browse/UNDERTOW-2339
- https://security.netapp.com/advisory/ntap-20241122-0008
More Red Hat Undertow vulnerabilities
- TI-2025-11507 Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf CVSS 3.1CRITICAL 9.6
- TI-2020-01688 Improper authorization in undertow-io undertow CVSS 3.1CRITICAL 9.8
- TI-2019-02898 Sensitive information in log files in Red Hat undertow CVSS 3.1CRITICAL 9.8
- TI-2019-07532 Sensitive information in log files in Red Hat undertow CVSS 3.1CRITICAL 9.8
- TI-2023-03019 Undertow: outofmemoryerror due to @multipartconfig handling CVSS 3.1HIGH 7.5
- TI-2014-06490 Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x before… CVSS 2.0MEDIUM 5.0
Sources
- CVE-2024-1459 · CVE Program
- CVE-2024-1459 · NVD
- FIRST EPSS
- GHSA-v76w-3ph8-vm66 · GitHub Advisory Database · CC BY 4.0
- CVE-2024-1459 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences