Login Request a demo
UN
Product
Undertow
by Redhat · last CVE Mar 27, 2026
39
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities39In the news0Timeline
Severity mix
Critical 7High 18Medium 13Low 0
Severity
All severities39Critical7High18Medium13Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Undertow to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2020-1745
9.8
5%
Apr 28
A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before and was fixed in…
Affected: through 2.0.29
CVE-2019-10212
9.8
2%
Oct 2
A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security
Affected: before 2.0.20
CVE-2019-3888
9.8
3%
Jun 12
A vulnerability was found in Undertow web server before 2.0.21
Affected: before 2.0.21
CVE-2025-12543
9.6
1%
Jan 7
Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf
Affected: before 2.2.39; 2.3.0 before 2.3.21
CVE-2026-28369
9.1
1%
Mar 27
Undertow: undertow: request smuggling via malformed http request headers
Affected: All versions, or not specified
CVE-2026-28367
9.1
1%
Mar 27
Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator
Affected: All versions, or not specified
CVE-2026-28368
9.1
1%
Mar 27
Undertow: undertow: request smuggling via inconsistent header parsing
Affected: All versions, or not specified
Showing 7