Medium severity · published Sep 11, 2018
CVE-2018-1114
It was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized which can cause file descriptors to exhaust
6.5
CVSS
2.3%
EPSS
No
On KEV
Description
It was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized which can cause file descriptors to exhaust. This leads to a file handler leak.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UN
Undertow · Redhat
All versions, or not specified · source: NVD
VI
Virtualization · Redhat
4.0; 4.2 · source: NVD
VH
Virtualization Host · Redhat
4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-1114
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-1114
Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:2643
Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:2669
Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:0877
Third Party Advisory
https://bugs.openjdk.java.net/browse/JDK-6956385
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1114
Issue Tracking
https://issues.jboss.org/browse/UNDERTOW-1338
More from Undertow
9.8
CVE-2020-1745
A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before and was fixed in…
9.8
CVE-2019-10212
A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security
9.8
CVE-2019-3888
A vulnerability was found in Undertow web server before 2.0.21
9.6
CVE-2025-12543
Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf
9.1
CVE-2026-28369
Undertow: undertow: request smuggling via malformed http request headers