Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

39 records

Vendor: Red Hat Component: Undertow Clear all filters
TI-2025-11507 CVE-2025-12543 · GHSA-j382-5jj3-vw4j

Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf

Priority HIGH 76

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.01333 Published 2026-01-07 Partial fix · 1.4.18-21.SP19_redhat_00001.1.ep7.el7, 2.0.41-8.SP9_redhat_00001.1.el7eap +50 CWE-20
TI-2025-08973 CVE-2025-9784 · GHSA-95h4-w6j8-2rp8

Undertow: undertow madeyoureset http/2 ddos vulnerability

Priority MEDIUM 43

A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02325 Published 2025-09-02 Partial fix · 2.2.38.Final, 1.4.18-21.SP19_redhat_00001.1.ep7.el7 +50 CWE-770
TI-2024-01362 CVE-2024-1459 · GHSA-v76w-3ph8-vm66

Undertow: directory traversal vulnerability

Priority LOW 27

A path traversal vulnerability was found in Undertow.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01714 Published 2024-02-12 Partial fix · 2.3.12, 2.16.0-18.redhat_00052.1.el8eap +57 CWE-24
TI-2022-04106 CVE-2022-4492 · GHSA-pfcc-3g6r-8rg8

Server-side request forgery in undertow

Priority MEDIUM 40

The undertow client is not checking the server identity presented by the server certificate in https connections.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00596 Published 2023-02-23 Partial fix · 2.3.5.Final, 2.2.24.Final CWE-918
TI-2022-01201 CVE-2022-1319 · GHSA-5r46-q4x7-6fx6

A flaw was found in Undertow.

Priority LOW 36

A flaw was found in Undertow.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01696 Published 2022-08-31 Partial fix CWE-252
TI-2021-02790 CVE-2021-3859 · GHSA-339q-62wm-c39w

Exposure of resource to wrong sphere in undertow

Priority LOW 36

A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01736 Published 2022-08-26 Partial fix · 2.2.15 CWE-214
TI-2022-01901 CVE-2022-2053 · GHSA-95rf-557x-44g5

Uncontrolled resource consumption in Undertow

Priority LOW 35

When a POST request comes through AJP and the request exceeds the max-post-size limit (maxEntitySize), Undertow's AjpServerRequestConduit implementation closes a connection without sending any response to the client/prox…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01093 Published 2022-08-05 Partial fix · 2.2.19.Final, 2.3.0.Alpha2 CWE-400
TI-2021-02544 CVE-2021-3597 · GHSA-mfhv-gwf8-4m88

Race condition in undertow

Priority LOW 29

A flaw was found in undertow.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.01161 Published 2022-05-24 Partial fix · 2.2.9.Final, 2.0.39.Final CWE-362
TI-2019-13955 CVE-2019-19343 · GHSA-4v4m-hgv5-x3qx

Uncontrolled resource consumption in Undertow

Priority LOW 36

A flaw was found in Undertow when using Remoting as shipped in Red Hat Jboss EAP before version 7.2.4.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0163 Published 2021-03-23 Partial fix CWE-400
TI-2020-16867 CVE-2020-27782 · GHSA-rhcw-wjcm-9h6g

Uncontrolled resource consumption in Undertow

Priority LOW 36

A flaw was found in the Undertow AJP connector.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01375 Published 2021-02-23 Partial fix · 2.1.5, 2.0.33 CWE-400
TI-2021-03516 CVE-2021-20220 · GHSA-qjwc-v72v-fq6r

A flaw was found in Undertow.

Priority LOW 24

A flaw was found in Undertow.

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.012 Published 2021-02-23 Partial fix · 2.1.6, 2.0.34 CWE-444
TI-2020-08590 CVE-2020-10687 · GHSA-p9w3-gwc2-cr49

A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP…

Priority LOW 25

A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP…

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.01231 Published 2020-09-23 Partial fix · 2.2.0.Final CWE-444
TI-2020-08606 CVE-2020-10705 · GHSA-g4cp-h53p-v3v8

Resource allocation without limits in Undertow

Priority LOW 36

A flaw was discovered in Undertow in versions before Undertow 2.1.1.Final where certain requests to the "Expect: 100-continue" header may cause an out of memory error.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01465 Published 2020-06-10 Partial fix · 2.1.1.Final CWE-770
TI-2020-01688 CVE-2020-1745 · GHSA-gv2w-88hx-8m9r

Improper authorization in undertow-io undertow

Priority MEDIUM 50

A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before and was fixed in 2.0.30.Final.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04957 Published 2020-04-28 Partial fix · 2.0.30 CWE-285
Load more