CVE-2026-28369

all versions

A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, i

8.7HIGH

CVE-2026-28368

all versions

A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header nam

8.7HIGH

CVE-2026-28367

all versions

A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending \r\r\r as a header block terminator. T

8.7HIGH

CVE-2026-3260

all versions

A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending an HTTP GET request containing multipa

5.9MEDIUM

CVE-2025-12543

< 2.2.39

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow

9.6CRITICAL

CVE-2025-9784

all versions

A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counte

7.5HIGH

CVE-2024-1459

all versions

A path traversal vulnerability was found in Undertow. This issue may allow a remote attacker to append a specially-crafted sequenc

5.3MEDIUM

CVE-2023-5379

all versions

A flaw was found in Undertow. When an AJP request is sent that exceeds the max-header-size attribute in ajp-listener, JBoss EAP is

7.5HIGH

CVE-2023-3223

< 2.2.24

A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart conten

7.5HIGH

CVE-2023-1108

< 2.2.24

A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status update

7.5HIGH

CVE-2022-4492

all versions

The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compul

7.5HIGH

CVE-2022-2764

>= 2.0.0 and <= 2.2.19

A flaw was found in Undertow. Denial of service can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invoca

4.9MEDIUM

CVE-2022-1319

< 2.2.17

A flaw was found in Undertow. For an AJP 400 response, EAP 7 is improperly sending two response packets, and those packets have th

7.5HIGH

CVE-2022-1259

<= 2.2.17

A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or

7.5HIGH

CVE-2021-3859

< 2.2.15

A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. This flaw allows

7.5HIGH

CVE-2021-3690

< 2.0.40

A flaw was found in Undertow. A buffer leak on the incoming WebSocket PONG message may lead to memory exhaustion. This flaw allows

7.5HIGH

CVE-2022-2053

< 2.2.19

When a POST request comes through AJP and the request exceeds the max-post-size limit (maxEntitySize), Undertow's AjpServerRequest

7.5HIGH

CVE-2021-3629

< 2.0.40

A flaw was found in Undertow. A potential security issue in flow control handling by the browser over http/2 may potentially cause

5.9MEDIUM

CVE-2021-3597

< 2.0.35

A flaw was found in undertow. The HTTP2SourceChannel fails to write the final frame under some circumstances, resulting in a denia

5.9MEDIUM

CVE-2019-19343

< 2.0.25

A flaw was found in Undertow when using Remoting as shipped in Red Hat Jboss EAP before version 7.2.4. A memory leak in HttpOpenLi

7.5HIGH

CVE-2020-27782

all versions

A flaw was found in the Undertow AJP connector. Malicious requests and abrupt connection closes could be triggered by an attacker

7.5HIGH

CVE-2021-20220

< 2.0.34

A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-266

4.8MEDIUM

CVE-2020-10687

< 2.2.0

A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-26

4.8MEDIUM

CVE-2020-10705

< 2.1.1

A flaw was discovered in Undertow in versions before Undertow 2.1.1.Final where certain requests to the "Expect: 100-continue" hea

7.5HIGH

CVE-2020-10719

< 2.1.1

A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk si

6.5MEDIUM

CVE-2020-1745

<= 2.0.29

A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow ve

8.6HIGH

CVE-2020-1757

< 2.1.0

A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions p

8.1HIGH

CVE-2019-14888

<= 2.0.28

A vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS. An attacker can targe

7.5HIGH

CVE-2019-10212

< 2.0.20

A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could a

9.8CRITICAL

CVE-2019-10184

< 2.0.23

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures pred

7.5HIGH

CVE-2019-3888

< 2.0.21

A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log file

9.8CRITICAL

CVE-2018-14642

all versions

An information leak vulnerability was found in Undertow. If all headers are not written out in the first write() call then the cod

5.3MEDIUM

CVE-2018-1114

all versions

It was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized which can cau

6.5MEDIUM

CVE-2017-2670

< 1.3.28

It was found in Undertow before 1.3.28 that with non-clean TCP close, the Websocket server gets into infinite loop on every IO thr

7.5HIGH

CVE-2017-12165

>= 1.0.0 and < 1.3.31

It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can

2.6LOW

CVE-2017-2666

all versions

It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters. This could be exploite

6.5MEDIUM

CVE-2018-1067

< 1.4.25

In Undertow before versions 7.1.2.CR1, 7.1.2.GA it was found that the fix for CVE-2016-4993 was incomplete and Undertow web server

6.1MEDIUM

CVE-2017-12196

<= 1.4.18

undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server d

4.8MEDIUM

CVE-2017-7559

>= 1.3.0 and < 1.3.31

In Undertow 2.x before 2.0.0.Alpha2, 1.4.x before 1.4.17.Final, and 1.3.x before 1.3.31.Final, it was found that the fix for CVE-2

6.1MEDIUM

CVE-2014-7816

<= 1.0.16

Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x before 1.1.0.CR5, and 1.2.x before 1.2.0.Beta3, whe