UN
Product
Undertow
39
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 18Medium 13Low 0
Watch
Add Undertow to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-10719 | 6.5 | May 26 | A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes Affected: before 2.1.1 |
| CVE-2018-1114 | 6.5 | Sep 11 | It was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized which can cause file descriptors to exhaust Affected: All versions, or not specified |
| CVE-2017-2666 | 6.5 | Jul 27 | It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters Affected: All versions, or not specified |
| CVE-2018-1067 | 6.1 | May 21 | In Undertow before versions 7.1.2.CR1, 7.1.2.GA it was found that the fix for CVE-2016-4993 was incomplete and Undertow web server is vulnerable to the injection of arbitrary HTTP… Affected: before 1.4.25; 2.0.0 before 2.0.5 |
| CVE-2017-7559 | 6.1 | Jan 10 | In Undertow 2.x before 2.0.0.Alpha2, 1.4.x before 1.4.17.Final, and 1.3.x before 1.3.31.Final, it was found that the fix for CVE-2017-2666 was incomplete and invalid characters… Affected: 1.3.0 before 1.3.31; 1.4.0 before 1.4.17; 2.0.0 |
| CVE-2021-3629 | 5.9 | May 24 | A flaw was found in Undertow Affected: before 2.0.40; 2.2.0 before 2.2.11 |
| CVE-2021-3597 | 5.9 | May 24 | A flaw was found in undertow Affected: before 2.0.35; 2.2.0 before 2.2.6; 2.0.35; 2.0.36; 2.0.39; 2.2.6; +2 more |
| CVE-2017-12196 | 5.9 | Apr 18 | undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the… Affected: through 1.4.18; 1.4.24; 2.0.2 |
| CVE-2024-1459 | 5.3 | Feb 12 | A path traversal vulnerability was found in Undertow Affected: All versions, or not specified |
| CVE-2018-14642 | 5.3 | Sep 18 | An information leak vulnerability was found in Undertow Affected: All versions, or not specified |
| CVE-2022-2764 | 4.9 | Sep 1 | A flaw was found in Undertow Affected: 2.0.0 through 2.2.19; 2.3.0; 2.3.0 |
| CVE-2021-20220 | 4.8 | Feb 23 | A flaw was found in Undertow Affected: before 2.0.34; 2.1.0 before 2.1.6 |
| CVE-2020-10687 | 4.8 | Sep 23 | A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to… Affected: before 2.2.0 |
Showing 13