UN
Product
Undertow
39
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 18Medium 13Low 0
Watch
Add Undertow to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-1745 | 9.8 | Apr 28 | A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before and was fixed in… Affected: through 2.0.29 |
| CVE-2019-10212 | 9.8 | Oct 2 | A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security Affected: before 2.0.20 |
| CVE-2019-3888 | 9.8 | Jun 12 | A vulnerability was found in Undertow web server before 2.0.21 Affected: before 2.0.21 |
| CVE-2025-12543 | 9.6 | Jan 7 | Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf Affected: before 2.2.39; 2.3.0 before 2.3.21 |
| CVE-2026-28369 | 9.1 | Mar 27 | Undertow: undertow: request smuggling via malformed http request headers Affected: All versions, or not specified |
| CVE-2026-28367 | 9.1 | Mar 27 | Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator Affected: All versions, or not specified |
| CVE-2026-28368 | 9.1 | Mar 27 | Undertow: undertow: request smuggling via inconsistent header parsing Affected: All versions, or not specified |
| CVE-2020-1757 | 8.1 | Apr 21 | A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final, where the Servlet… Affected: before 2.1.0; 2.0.0; 2.0.25; 2.0.26; 2.0.28; 2.0.28 |
| CVE-2025-9784 | 7.5 | Sep 2 | Undertow: undertow madeyoureset http/2 ddos vulnerability Affected: All versions, or not specified |
| CVE-2023-5379 | 7.5 | Dec 12 | A flaw was found in Undertow Affected: All versions, or not specified |
| CVE-2023-3223 | 7.5 | Sep 27 | A flaw was found in undertow Affected: before 2.2.24 |
| CVE-2023-1108 | 7.5 | Sep 14 | A flaw was found in undertow Affected: before 2.2.24; 2.3.0 before 2.3.5 |
| CVE-2022-4492 | 7.5 | Feb 23 | The undertow client is not checking the server identity presented by the server certificate in https connections Affected: 2.7.0 |
| CVE-2022-1319 | 7.5 | Aug 31 | A flaw was found in Undertow Affected: before 2.2.17; 2.2.17; 2.2.17; 2.2.17; 2.2.19; 2.2.19; +1 more |
| CVE-2022-1259 | 7.5 | Aug 31 | A flaw was found in Undertow Affected: through 2.2.17; 2.2.18; 2.2.19 |
| CVE-2021-3859 | 7.5 | Aug 26 | A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2 Affected: before 2.2.15 |
| CVE-2021-3690 | 7.5 | Aug 23 | A flaw was found in Undertow Affected: before 2.0.40; 2.1.0 before 2.2.10 |
| CVE-2022-2053 | 7.5 | Aug 5 | When a POST request comes through AJP and the request exceeds the max-post-size limit (maxEntitySize), Undertow's AjpServerRequestConduit implementation closes a connection… Affected: before 2.2.19; 2.3.0 |
| CVE-2019-19343 | 7.5 | Mar 23 | A flaw was found in Undertow when using Remoting as shipped in Red Hat Jboss EAP before version 7.2.4 Affected: before 2.0.25; 2.0.25 |
| CVE-2020-27782 | 7.5 | Feb 23 | A flaw was found in the Undertow AJP connector Affected: 2.0.33; 2.1.5; 2.2.3 |
| CVE-2020-10705 | 7.5 | Jun 10 | A flaw was discovered in Undertow in versions before Undertow 2.1.1.Final where certain requests to the "Expect: 100-continue" header may cause an out of memory error Affected: before 2.1.1 |
| CVE-2019-14888 | 7.5 | Jan 23 | A vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS Affected: through 2.0.28 |
| CVE-2019-10184 | 7.5 | Jul 25 | undertow before version 2.0.23.Final is vulnerable to an information leak issue Affected: before 2.0.23 |
| CVE-2017-2670 | 7.5 | Jul 27 | It was found in Undertow before 1.3.28 that with non-clean TCP close, the Websocket server gets into infinite loop on every IO thread, effectively causing DoS Affected: before 1.3.28 |
| CVE-2017-12165 | 7.5 | Jul 27 | It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling Affected: 1.0.0 before 1.3.31; 1.4.0 before 1.4.17; 2.0.0 |
| CVE-2020-10719 | 6.5 | May 26 | A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes Affected: before 2.1.1 |
| CVE-2018-1114 | 6.5 | Sep 11 | It was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized which can cause file descriptors to exhaust Affected: All versions, or not specified |
| CVE-2017-2666 | 6.5 | Jul 27 | It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters Affected: All versions, or not specified |
| CVE-2018-1067 | 6.1 | May 21 | In Undertow before versions 7.1.2.CR1, 7.1.2.GA it was found that the fix for CVE-2016-4993 was incomplete and Undertow web server is vulnerable to the injection of arbitrary HTTP… Affected: before 1.4.25; 2.0.0 before 2.0.5 |
| CVE-2017-7559 | 6.1 | Jan 10 | In Undertow 2.x before 2.0.0.Alpha2, 1.4.x before 1.4.17.Final, and 1.3.x before 1.3.31.Final, it was found that the fix for CVE-2017-2666 was incomplete and invalid characters… Affected: 1.3.0 before 1.3.31; 1.4.0 before 1.4.17; 2.0.0 |
| CVE-2021-3629 | 5.9 | May 24 | A flaw was found in Undertow Affected: before 2.0.40; 2.2.0 before 2.2.11 |
| CVE-2021-3597 | 5.9 | May 24 | A flaw was found in undertow Affected: before 2.0.35; 2.2.0 before 2.2.6; 2.0.35; 2.0.36; 2.0.39; 2.2.6; +2 more |
| CVE-2017-12196 | 5.9 | Apr 18 | undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the… Affected: through 1.4.18; 1.4.24; 2.0.2 |
| CVE-2024-1459 | 5.3 | Feb 12 | A path traversal vulnerability was found in Undertow Affected: All versions, or not specified |
| CVE-2018-14642 | 5.3 | Sep 18 | An information leak vulnerability was found in Undertow Affected: All versions, or not specified |
| CVE-2022-2764 | 4.9 | Sep 1 | A flaw was found in Undertow Affected: 2.0.0 through 2.2.19; 2.3.0; 2.3.0 |
| CVE-2021-20220 | 4.8 | Feb 23 | A flaw was found in Undertow Affected: before 2.0.34; 2.1.0 before 2.1.6 |
| CVE-2020-10687 | 4.8 | Sep 23 | A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to… Affected: before 2.2.0 |
| CVE-2014-7816 | – | Dec 1 | Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x before 1.1.0.CR5, and 1.2.x before 1.2.0.Beta3, when running on Windows, allows remote attackers to… Affected: through 1.0.16; through 1.1.0; through 1.2.0 |
Showing 39