UN
Product
Undertow
39
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 18Medium 13Low 0
Watch
Add Undertow to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-1757 | 8.1 | Apr 21 | A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final, where the Servlet… Affected: before 2.1.0; 2.0.0; 2.0.25; 2.0.26; 2.0.28; 2.0.28 |
| CVE-2025-9784 | 7.5 | Sep 2 | Undertow: undertow madeyoureset http/2 ddos vulnerability Affected: All versions, or not specified |
| CVE-2023-5379 | 7.5 | Dec 12 | A flaw was found in Undertow Affected: All versions, or not specified |
| CVE-2023-3223 | 7.5 | Sep 27 | A flaw was found in undertow Affected: before 2.2.24 |
| CVE-2023-1108 | 7.5 | Sep 14 | A flaw was found in undertow Affected: before 2.2.24; 2.3.0 before 2.3.5 |
| CVE-2022-4492 | 7.5 | Feb 23 | The undertow client is not checking the server identity presented by the server certificate in https connections Affected: 2.7.0 |
| CVE-2022-1319 | 7.5 | Aug 31 | A flaw was found in Undertow Affected: before 2.2.17; 2.2.17; 2.2.17; 2.2.17; 2.2.19; 2.2.19; +1 more |
| CVE-2022-1259 | 7.5 | Aug 31 | A flaw was found in Undertow Affected: through 2.2.17; 2.2.18; 2.2.19 |
| CVE-2021-3859 | 7.5 | Aug 26 | A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2 Affected: before 2.2.15 |
| CVE-2021-3690 | 7.5 | Aug 23 | A flaw was found in Undertow Affected: before 2.0.40; 2.1.0 before 2.2.10 |
| CVE-2022-2053 | 7.5 | Aug 5 | When a POST request comes through AJP and the request exceeds the max-post-size limit (maxEntitySize), Undertow's AjpServerRequestConduit implementation closes a connection… Affected: before 2.2.19; 2.3.0 |
| CVE-2019-19343 | 7.5 | Mar 23 | A flaw was found in Undertow when using Remoting as shipped in Red Hat Jboss EAP before version 7.2.4 Affected: before 2.0.25; 2.0.25 |
| CVE-2020-27782 | 7.5 | Feb 23 | A flaw was found in the Undertow AJP connector Affected: 2.0.33; 2.1.5; 2.2.3 |
| CVE-2020-10705 | 7.5 | Jun 10 | A flaw was discovered in Undertow in versions before Undertow 2.1.1.Final where certain requests to the "Expect: 100-continue" header may cause an out of memory error Affected: before 2.1.1 |
| CVE-2019-14888 | 7.5 | Jan 23 | A vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS Affected: through 2.0.28 |
| CVE-2019-10184 | 7.5 | Jul 25 | undertow before version 2.0.23.Final is vulnerable to an information leak issue Affected: before 2.0.23 |
| CVE-2017-2670 | 7.5 | Jul 27 | It was found in Undertow before 1.3.28 that with non-clean TCP close, the Websocket server gets into infinite loop on every IO thread, effectively causing DoS Affected: before 1.3.28 |
| CVE-2017-12165 | 7.5 | Jul 27 | It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling Affected: 1.0.0 before 1.3.31; 1.4.0 before 1.4.17; 2.0.0 |
Showing 18