Jastow: jastow cross-site scripting attack due to unsanitized uri

Summary

A flaw was found in Jastow. Jastow is vulnerable to Cross-Site Scripting (XSS) attack. If using a set of combined configuration to allow unescaped characters in URL with embedded Undertow and Jastow, a server might be vulnerable to improper input handling.

Timeline

1. Jul 7, 2026, 4:18 PM UTCCVE published
2. Jul 9, 2026, 1:34 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Jul 29, 2026, 4:24 PM UTCRecord last updated

Affected versions

• io.undertow.jastow/jastow

  Version range not reported

• eap8

  Version range not reported

• eap8-activemq-artemis

  Version range not reported

• eap8-activemq-artemis-native

  Version range not reported

• eap8-aesh-extensions

  Version range not reported

• eap8-aesh-readline

  Version range not reported

• eap8-agroal

  Version range not reported

• eap8-angus

  Version range not reported

• eap8-angus-activation

  Version range not reported

• eap8-antlr4

  Version range not reported

• eap8-apache-commons-beanutils

  Version range not reported

• eap8-apache-commons-cli

  Version range not reported

• eap8-apache-commons-codec

  Version range not reported

• eap8-apache-commons-collections

  Version range not reported

• eap8-apache-commons-io

  Version range not reported

• eap8-apache-commons-lang

  Version range not reported

• eap8-apache-cxf

  Version range not reported

• eap8-apache-cxf-xjc-utils

  Version range not reported

• eap8-apache-mime4j

  Version range not reported

• eap8-apache-sshd

  Version range not reported

• eap8-artemis-native

  Version range not reported

• eap8-artemis-wildfly-integration

  Version range not reported

• eap8-asyncutil

  Version range not reported

• eap8-atinject

  Version range not reported

• eap8-aws-java-sdk

  Version range not reported

• eap8-azure-storage

  Version range not reported

• eap8-bouncycastle

  Version range not reported

• eap8-byte-buddy

  Version range not reported

• eap8-caffeine

  Version range not reported

• eap8-commons-logging-jboss-logging

  Version range not reported

• eap8-cryptacular

  Version range not reported

• eap8-eap-product-conf-parent

  Version range not reported

• eap8-ecj

  Version range not reported

• eap8-eclipse-jgit

  Version range not reported

• eap8-elasticsearch

  Version range not reported

• eap8-elytron-web

  Version range not reported

• eap8-eventstream

  Version range not reported

• eap8-expressly

  Version range not reported

• eap8-fastinfoset

  Version range not reported

• eap8-fge-btf

  Version range not reported

• eap8-fge-msg-simple

  Version range not reported

• eap8-gnu-getopt

  Version range not reported

• eap8-gson

  Version range not reported

• eap8-guava-failureaccess

  Version range not reported

• eap8-guava-libraries

  Version range not reported

• eap8-h2database

  Version range not reported

• eap8-hal-console

  Version range not reported

• eap8-hibernate

  Version range not reported

• eap8-hibernate-commons-annotations

  Version range not reported

• eap8-hibernate-search

  Version range not reported

• eap8-hibernate-validator

  Version range not reported

• eap8-hornetq

  Version range not reported

• eap8-hppc

  Version range not reported

• eap8-httpcomponents-asyncclient

  Version range not reported

• eap8-httpcomponents-client

  Version range not reported

• eap8-httpcomponents-core

  Version range not reported

• eap8-infinispan

  Version range not reported

• eap8-insights-java-client

  Version range not reported

• eap8-installation-manager-api

  Version range not reported

• eap8-ironjacamar

  Version range not reported

• eap8-jackson-annotations

  Version range not reported

• eap8-jackson-core

  Version range not reported

• eap8-jackson-coreutils

  Version range not reported

• eap8-jackson-databind

  Version range not reported

• eap8-jackson-dataformats-text

  Version range not reported

• eap8-jackson-jaxrs-providers

  Version range not reported

• eap8-jackson-modules-base

  Version range not reported

• eap8-jackson-modules-java8

  Version range not reported

• eap8-jakarta-activation

  Version range not reported

• eap8-jakarta-annotation-api

  Version range not reported

• eap8-jakarta-authentication-api

  Version range not reported

• eap8-jakarta-authorization-api

  Version range not reported

• eap8-jakarta-batch-api

  Version range not reported

• eap8-jakarta-ejb-api

  Version range not reported

• eap8-jakarta-enterprise-concurrent

  Version range not reported

• eap8-jakarta-enterprise-concurrent-api

  Version range not reported

• eap8-jakarta-enterprise-lang-model

  Version range not reported

• eap8-jakarta-interceptor-api

  Version range not reported

• eap8-jakarta-jms-api

  Version range not reported

• eap8-jakarta-json

  Version range not reported

• eap8-jakarta-json-api

  Version range not reported

• eap8-jakarta-mail

  Version range not reported

• eap8-jakarta-resource-api

  Version range not reported

• eap8-jakarta-security-enterprise-api

  Version range not reported

• eap8-jakarta-servlet-api

  Version range not reported

• eap8-jakarta-servlet-jsp-api

  Version range not reported

• eap8-jakarta-servlet-jsp-jstl-api

  Version range not reported

• eap8-jakarta-transaction-api

  Version range not reported

• eap8-jakarta-validation-api

  Version range not reported

• eap8-jakarta-websocket

  Version range not reported

• eap8-jakarta-ws-rs-api

  Version range not reported

• eap8-jakarta-xml-bind-api

  Version range not reported

• eap8-jandex

  Version range not reported

• eap8-jansi

  Version range not reported

• eap8-jasypt

  Version range not reported

• eap8-java-classmate

  Version range not reported

• eap8-javaee-jpa-spec

  Version range not reported

• eap8-javaee-security-soteria

  Version range not reported

• eap8-javaewah

  Version range not reported

• eap8-javapackages-tools

  Version range not reported

• eap8-jaxb

  Version range not reported

• eap8-jaxbintros

  Version range not reported

• eap8-jberet

  Version range not reported

• eap8-jboss-aesh

  Version range not reported

• eap8-jboss-cert-helper

  Version range not reported

• eap8-jboss-classfilewriter

  Version range not reported

• eap8-jboss-common-beans

  Version range not reported

• eap8-jboss-dmr

  Version range not reported

• eap8-jboss-ejb3-ext-api

  Version range not reported

• eap8-jboss-ejb-client

  Version range not reported

• eap8-jboss-el-api_5.0_spec

  Version range not reported

• eap8-jboss-genericjms

  Version range not reported

• eap8-jboss-iiop-client

  Version range not reported

• eap8-jboss-invocation

  Version range not reported

• eap8-jboss-jakarta-xml-ws-api_4.0_spec

  Version range not reported

• eap8-jboss-logging

  Version range not reported

• eap8-jboss-logmanager

  Version range not reported

• eap8-jboss-marshalling

  Version range not reported

• eap8-jboss-metadata

  Version range not reported

• eap8-jboss-modules

  Version range not reported

• eap8-jboss-msc

  Version range not reported

• eap8-jboss-openjdk-orb

  Version range not reported

• eap8-jboss-remoting

  Version range not reported

• eap8-jboss-remoting-jmx

  Version range not reported

• eap8-jboss-saaj-api_3.0_spec

  Version range not reported

• eap8-jboss-stdio

  Version range not reported

• eap8-jboss-threads

  Version range not reported

• eap8-jboss-transaction-spi

  Version range not reported

• eap8-jboss-vfs

  Version range not reported

• eap8-jboss-weld-api

  Version range not reported

• eap8-jbossws-api

  Version range not reported

• eap8-jbossws-common

  Version range not reported

• eap8-jbossws-common-tools

  Version range not reported

• eap8-jbossws-cxf

  Version range not reported

• eap8-jbossws-jaxws-undertow-httpspi

  Version range not reported

• eap8-jbossws-spi

  Version range not reported

• eap8-jboss-xnio-base

  Version range not reported

• eap8-jcip-annotations

  Version range not reported

• eap8-jctools

  Version range not reported

• eap8-jgroups

  Version range not reported

• eap8-jgroups-aws

  Version range not reported

• eap8-jgroups-azure

  Version range not reported

• eap8-jgroups-kubernetes

  Version range not reported

• eap8-joda-time

  Version range not reported

• eap8-jose4j

  Version range not reported

• eap8-jsf-impl

  Version range not reported

• eap8-jsonb-spec

  Version range not reported

• eap8-json-patch

  Version range not reported

• eap8-jul-to-slf4j-stub

  Version range not reported

• eap8-log4j

  Version range not reported

• eap8-log4j2-jboss-logmanager

  Version range not reported

• eap8-lucene-solr

  Version range not reported

• eap8-mod_cluster

  Version range not reported

• eap8-narayana

  Version range not reported

• eap8-neethi

  Version range not reported

• eap8-netty

  Version range not reported

• eap8-netty-transport-native-epoll

  Version range not reported

• eap8-netty-xnio-transport

  Version range not reported

• eap8-nimbus-jose-jwt

  Version range not reported

• eap8-objectweb-asm

  Version range not reported

• eap8-opensaml

  Version range not reported

• eap8-parsson

  Version range not reported

• eap8-pem-keystore

  Version range not reported

• eap8-plexus-utils

  Version range not reported

• eap8-protoparser

  Version range not reported

• eap8-protostream

  Version range not reported

• eap8-reactive-streams

  Version range not reported

• eap8-reactivex-rxjava

  Version range not reported

• eap8-reactivex-rxjava2

  Version range not reported

• eap8-resilience4j

  Version range not reported

• eap8-resteasy

  Version range not reported

• eap8-resteasy-extensions

  Version range not reported

• eap8-resteasy-spring

  Version range not reported

• eap8-saaj-impl

  Version range not reported

• eap8-shibboleth-java-support

  Version range not reported

• eap8-slf4j

  Version range not reported

• eap8-slf4j-jboss-logmanager

  Version range not reported

• eap8-snakeyaml

  Version range not reported

• eap8-stax2-api

  Version range not reported

• eap8-stax-ex

  Version range not reported

• eap8-staxmapper

  Version range not reported

• eap8-sun-istack-commons

  Version range not reported

• eap8-undertow

  Version range not reported

• eap8-undertow-jastow

  Version range not reported

• eap8-vdx

  Version range not reported

• eap8-velocity

  Version range not reported

• eap8-weld-core

  Version range not reported

• eap8-wildfly

  Version range not reported

• eap8-wildfly-client-config

  Version range not reported

• eap8-wildfly-clustering

  Version range not reported

• eap8-wildfly-common

  Version range not reported

• eap8-wildfly-discovery

  Version range not reported

• eap8-wildfly-elytron

  Version range not reported

• eap8-wildfly-elytron-ee

  Version range not reported

• eap8-wildfly-http-client

  Version range not reported

• eap8-wildfly-javadocs

  Version range not reported

• eap8-wildfly-naming-client

  Version range not reported

• eap8-wildfly-openssl

  Version range not reported

• eap8-wildfly-openssl-el10-x86_64

  Version range not reported

• eap8-wildfly-transaction-client

  Version range not reported

• eap8-woodstox-core

  Version range not reported

• eap8-ws-commons-XmlSchema

  Version range not reported

• eap8-wsdl4j

  Version range not reported

• eap8-wss4j

  Version range not reported

• eap8-xml-commons-resolver

  Version range not reported

• eap8-xml-security

  Version range not reported

• eap8-yasson

  Version range not reported

• eap8-apache-cxf

  Version range not reported

• eap8-artemis-wildfly-integration

  Version range not reported

• eap8-eap-product-conf-parent

  Version range not reported

• eap8-hibernate

  Version range not reported

• eap8-jbossws-cxf

  Version range not reported

• eap8-jgroups

  Version range not reported

• eap8-undertow

  Version range not reported

• eap8-undertow-jastow

  Version range not reported

• eap8-wildfly

  Version range not reported

• eap8-wildfly-elytron

  Version range not reported

• eap8-wildfly-javadocs

  Version range not reported

• eap8-apache-cxf

  Version range not reported

• eap8-artemis-wildfly-integration

  Version range not reported

• eap8-eap-product-conf-parent

  Version range not reported

• eap8-hibernate

  Version range not reported

• eap8-jbossws-cxf

  Version range not reported

• eap8-jgroups

  Version range not reported

• eap8-undertow

  Version range not reported

• eap8-undertow-jastow

  Version range not reported

• eap8-wildfly

  Version range not reported

• eap8-wildfly-elytron

  Version range not reported

• eap8-wildfly-javadocs

  Version range not reported

• eap74-els-openjdk11-openshift-rhel8/eap74-els-openjdk11-openshift-rhel8

  Version range not reported

• eap74-els-openjdk17-openshift-rhel8/eap74-els-openjdk17-openshift-rhel8

  Version range not reported

• eap74-els-openjdk8-openshift-rhel8/eap74-els-openjdk8-openshift-rhel8

  Version range not reported

• io.undertow.jastow-jastow

  Version range not reported

• jastow

  Version range not reported

• jboss-eap-7/eap74-els-openjdk17-openshift-rhel8

  Version range not reported

• jboss-eap-7/eap74-els-openjdk8-openshift-rhel8

  Version range not reported

• jastow

  Version range not reported

• io.undertow.jastow-jastow

  Version range not reported

• jastow

  Version range not reported

• jastow

  Version range not reported

References 6