undertow
22 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2025-9784 | < 2.2.38.Final | Undertow: undertow madeyoureset http/2 ddos vulnerability | HIGH 7.5 | 2.3 % | ||
| CVE-2024-7885 | < 2.2.36.Final ; 2.3.0.Alpha1 – < 2.3.17.Final | Undertow: improper state management in proxy protocol parsing causes information leakage | HIGH 7.5 | 2.6 % | ||
| CVE-2024-3653 | ≤ 2.3.14.Final | Undertow: learningpushhandler can lead to remote memory dos attacks | MEDIUM 5.3 | 1.9 % | ||
| CVE-2024-5971 | < 2.2.34.Final ; 2.3.0.Alpha1 – < 2.3.15.Final | Undertow: response write hangs in case of java 17 tlsv1.3 newsessionticket | HIGH 7.5 | 2.9 % | ||
| CVE-2024-6162 | < 2.2.33.Final ; 2.3.0.Alpha1 – < 2.3.14 | Undertow: url-encoded request path information can be broken on ajp-listener | HIGH 7.5 | 1.7 % | ||
| CVE-2024-1635 | 1.31.0 | Undertow: out-of-memory error after several closed connections with wildfly-http-client protocol | HIGH 7.5 | 4.6 % | ||
| CVE-2024-1459 | < 2.3.12 | Undertow: directory traversal vulnerability | MEDIUM 5.3 | 1.7 % | ||
| CVE-2022-4492 | 2.7 | The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step | HIGH 7.5 | 0.6 % | ||
| CVE-2022-2764 | undertow 2.x | A flaw was found in Undertow. Denial of service can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations. | MEDIUM 4.9 | 0.9 % | ||
| CVE-2022-1319 | Fixed in 2.3.0.Final, 2.2.18.Final, 2.2.17.SP3, 2.2.17.SP4, 2.3.0.Alpha2 | A flaw was found in Undertow. For an AJP 400 response, EAP 7 is improperly sending two response packets, and those packets have the reuse fl | HIGH 7.5 | 1.7 % | ||
| CVE-2022-1259 | Fixed in 2.3.0.Final, 2.2.17.SP1, 2.2.20.Final, 2.2.19.SP1. | A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial | HIGH 7.5 | 1.4 % | ||
| CVE-2021-3859 | Fixed in 2.2.15.Final | A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. This flaw allows an attacke | HIGH 7.5 | 1.7 % | ||
| CVE-2021-3690 | Fixed in 2.2.10.Final, 2.0.40.Final | A flaw was found in Undertow. A buffer leak on the incoming WebSocket PONG message may lead to memory exhaustion. This flaw allows an attack | HIGH 7.5 | 1.8 % | ||
| CVE-2022-2053 | Fixed in Undertow 2.2.19.Final, Undertow 2.3.0.Alpha2 | When a POST request comes through AJP and the request exceeds the max-post-size limit (maxEntitySize), Undertow's AjpServerRequestConduit im | HIGH 7.5 | 1.1 % | ||
| CVE-2021-3597 | undertow 2.0.35.SP1, undertow 2.2.6.SP1, undertow 2.2.7.SP1, undertow 2.0.36.SP1, undertow 2.2.9.Final, undertow 2.0.39.Final | A flaw was found in undertow. The HTTP2SourceChannel fails to write the final frame under some circumstances, resulting in a denial of servi | MEDIUM 5.9 | 1.2 % | ||
| CVE-2021-3629 | undertow 2.0.40.Final, undertow 2.2.11.Final | A flaw was found in Undertow. A potential security issue in flow control handling by the browser over http/2 may potentially cause overhead | MEDIUM 5.9 | 1.3 % | ||
| CVE-2019-19343 | undertow 2.0.25.SP1, jboss-remoting 5.0.14.SP1 | A flaw was found in Undertow when using Remoting as shipped in Red Hat Jboss EAP before version 7.2.4. A memory leak in HttpOpenListener due | HIGH 7.5 | 1.6 % | ||
| CVE-2020-27782 | 2.1.5.SP1 ; 2.0.33.SP2 ; 2.2.3.SP1 | A flaw was found in the Undertow AJP connector. Malicious requests and abrupt connection closes could be triggered by an attacker using quer | HIGH 7.5 | 1.4 % | ||
| CVE-2021-20220 | Undertow 2.2.0.Final, Undertow 2.1.6.Final, Undertow 2.0.34.Final | A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possi | MEDIUM 4.8 | 1.2 % | ||
| CVE-2020-10687 | Undertow 2.2.0.Final | A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is poss | MEDIUM 4.8 | 1.2 % | ||
| CVE-2020-10705 | Versions before Undertow 2.1.1.Final. | A flaw was discovered in Undertow in versions before Undertow 2.1.1.Final where certain requests to the "Expect: 100-continue" header may ca | HIGH 7.5 | 1.2 % | ||
| CVE-2017-12196 | undertow 1.4.18.SP1 ; undertow 2.0.2.Final ; undertow 1.4.24.Final | undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not en | MEDIUM 5.9 | 2.0 % |