- Latest release
- 2.4.4.Final (Oct 3, 2026): no advisory affects it
- Newest unaffected release
- 2.4.4.Final (Oct 3, 2026), the latest release
- Advisories
- 41 · 1 critical, 17 high, 9 medium, 1 low
- Dependents
- 323
- Releases
- 353 since 1.0.0.Final (Feb 10, 2014)
- Registry
- Maven Central
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-28369Affects 1.0.0.Alpha1 to 2.2.39.Final (2.2.40.Final is outside it); 2.3.0.Final to 2.3.24.Final (2.3.25.Final is outside it)
- CVE-2026-28367Affects 1.0.0.Alpha1 to 2.2.39.Final (2.2.40.Final is outside it); 2.3.0.Final to 2.3.24.Final (2.3.25.Final is outside it)
- CVE-2026-28368Affects 1.0.0.Alpha1 to 2.2.39.Final (2.2.40.Final is outside it); 2.3.0.Final to 2.3.24.Final (2.3.25.Final is outside it)
- CVE-2024-4027Affects 1.0.0.Alpha1 to 2.2.38.Final (2.2.39.Final is outside it); 2.3.0.Alpha1 to 2.3.20.Final (2.3.21.Final is outside it); 2.4.0.Alpha1 (2.4.0.Beta1 is outside it)
- CVE-2025-12543Affects 1.0.0.Alpha1 to 2.2.38.Final (2.2.39.Final is outside it); 2.3.0.Alpha1 to 2.3.20.Final (2.3.21.Final is outside it); 2.4.0.Alpha1 (2.4.0.Beta1 is outside it)
- CVE-2024-3884Affects 1.0.0.Alpha1 to 2.2.38.Final (2.2.39.Final is outside it); 2.3.0.Alpha1 to 2.3.20.Final (2.3.21.Final is outside it); 2.4.0.Alpha1 (2.4.0.Beta1 is outside it)
- CVE-2025-9784Affects 1.0.0.Alpha1 to 2.2.37.Final (2.2.38.Final is outside it); 2.3.0.Alpha1 to 2.3.19.Final (2.3.20.Final is outside it)
- CVE-2023-4639Affects 1.0.0.Alpha1 to 2.2.29.Final (2.2.30.Final is outside it); 2.3.0.Alpha1 to 2.3.10.Final (2.3.11.Final is outside it)
- CVE-2023-1973Affects 1.0.0.Alpha1 to 2.2.31.Final (2.2.32.Final is outside it); 2.3.0.Alpha1 to 2.3.12.Final (2.3.13.Final is outside it)
- CVE-2024-7885Affects 1.0.0.Alpha1 to 2.2.35.Final (2.2.36.Final is outside it); 2.3.0.Alpha1 to 2.3.16.Final (2.3.17.Final is outside it)
- CVE-2024-3653Affects 1.0.0.Alpha1 to 2.2.33.Final (2.2.34.Final is outside it); 2.3.0.Alpha1 to 2.3.14.Final (2.3.15.Final is outside it)
- CVE-2024-5971Affects 1.0.0.Alpha1 to 2.2.33.Final (2.2.34.Final is outside it); 2.3.0.Alpha1 to 2.3.14.Final (2.3.15.Final is outside it)
Show all 41 advisoriesShow fewer advisories
- CVE-2024-6162Affects 1.0.0.Alpha1 to 2.2.32.Final (2.2.33.Final is outside it); 2.3.0.Alpha1 to 2.3.13.Final (2.3.14.Final is outside it)
- CVE-2024-1635Affects 1.0.0.Alpha1 to 2.2.30.Final (2.2.31.Final is outside it); 2.3.0.Final to 2.3.11.Final (2.3.12.Final is outside it)
- CVE-2024-1459Affects 1.0.0.Alpha1 to 2.2.30.Final (2.2.31.Final is outside it); 2.3.0.Alpha1 to 2.3.11.Final (2.3.12.Final is outside it)
- CVE-2023-1108Affects 1.0.0.Alpha1 to 2.2.23.Final (2.2.24.Final is outside it); 2.3.0.Final to 2.3.4.Final (2.3.5.Final is outside it)
- CVE-2022-4492Affects 1.0.0.Alpha1 to 2.2.23.Final (2.2.24.Final is outside it); 2.3.0.Final to 2.3.4.Final (2.3.5.Final is outside it)
- CVE-2021-3859Affects 1.0.0.Alpha1 to 2.2.14.Final (2.2.15.Final is outside it)
- CVE-2021-3690Affects 1.0.0.Alpha1 to 2.0.39.Final (2.0.40.Final is outside it); 2.2.0.Final to 2.2.9.Final (2.2.10.Final is outside it)
- CVE-2022-2053Affects 1.0.0.Alpha1 to 2.2.18.Final (2.2.19.Final is outside it); 2.3.0.Alpha1 (2.3.0.Alpha2 is outside it)
- CVE-2021-3597Affects 1.0.0.Alpha1 to 2.0.38.Final (2.0.39.Final is outside it); 2.1.0.Final to 2.2.8.Final (2.2.9.Final is outside it)
- CVE-2021-3629Affects 1.0.0.Alpha1 to 2.0.39.Final (2.0.40.Final is outside it); 2.1.0.Final to 2.2.10.Final (2.2.11.Final is outside it)
- CVE-2020-27782Affects 1.0.0.Alpha1 to 2.0.32.Final (2.0.33.Final is outside it); 2.1.0.Final to 2.1.4.Final (2.1.5.Final is outside it)
- CVE-2021-20220Affects 1.0.0.Alpha1 to 2.0.33.Final (2.0.34.Final is outside it); 2.1.0.Final to 2.1.5.Final (2.1.6.Final is outside it)
- CVE-2020-10687Affects 1.0.0.Alpha1 to 2.1.8.Final (2.2.0.Final is outside it)
- CVE-2020-10705Affects 1.0.0.Alpha1 to 2.1.0.Final (2.1.1.Final is outside it)
- CVE-2020-10719Affects 1.0.0.Alpha1 to 2.1.0.Final (2.1.1.Final is outside it)
- CVE-2020-1745Affects 1.0.0.Alpha1 to 2.0.29.Final (2.0.30.Final is outside it)
- CVE-2020-1757Affects 1.0.0.Alpha1 to 2.0.42.Final (2.1.0.Final is outside it)
- CVE-2019-14888Affects 1.0.0.Alpha1 to 2.0.28.Final (2.0.29.Final is outside it)
- CVE-2019-10212Affects 1.0.0.Alpha1 to 2.0.19.Final (2.0.20.Final is outside it)
- CVE-2019-3888Affects 1.0.0.Alpha1 to 2.0.20.Final (2.0.21.Final is outside it)
- CVE-2018-14642Affects 1.0.0.Alpha1 to 2.0.18.Final (2.0.19.Final is outside it)
- CVE-2018-1114Affects 1.0.0.Alpha1 to 1.4.24.Final (1.4.25.Final is outside it); 2.0.0.Alpha1 to 2.0.4.Final (2.0.5.Final is outside it)
- CVE-2017-2670Affects 1.0.0.Alpha1 to 1.3.27.Final (1.3.28.Final is outside it)
- CVE-2017-12165Affects 1.0.0.Alpha1 to 1.3.30.Final (1.3.31.Final is outside it); 1.4.0.Final to 1.4.16.Final (1.4.17.Final is outside it); 2.0.0.Alpha1 (2.0.0.Beta1 is outside it)
- CVE-2017-2666Affects 1.0.0.Alpha1 to 1.3.30.Final (1.3.31.Final is outside it); 1.4.0.Final to 1.4.16.Final (1.4.17.Final is outside it)
- CVE-2017-12196Affects 1.0.0.Alpha1 to 1.4.23.Final (1.4.24.Final is outside it); 2.0.0.Alpha1 to 2.0.1.Final (2.0.2.Final is outside it)
- CVE-2017-7559Affects 1.3.0.Final to 1.3.30.Final (1.3.31.Final is outside it); 1.4.0.Final to 1.4.16.Final (1.4.17.Final is outside it); 2.0.0.Alpha1 (2.0.0.Beta1 is outside it)
- CVE-2016-7046Affects 1.0.0.Alpha1 to 1.3.24.Final (1.3.25.Final is outside it); 1.4.0.Final to 1.4.2.Final (1.4.3.Final is outside it)
- CVE-2014-7816Affects 1.0.0.Final to 1.0.16.Final (1.0.17.Final is outside it); 1.1.0.Beta1 to 1.1.0.CR4 (1.1.0.CR5 is outside it); 1.2.0.Beta1 to 1.2.0.Beta2 (1.2.0.Beta3 is outside it)
Advisories 41
- CVE-2026-28369High 8.7
Undertow: undertow: request smuggling via malformed http request headers
Affected: fixed in 2.2.40.Final; from 2.3.0.Final, fixed in 2.3.25.Final.
Fixed in 2.2.40.Final (released Jun 27, 2026, 92 days after disclosure) and 2.3.25.Final (released Jun 27, 2026, 92 days after disclosure).
The latest release, 2.4.4.Final, is not affected.
- CVE-2026-28367High 8.7
Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator
Affected: from 2.3.0.Final, fixed in 2.3.25.Final; fixed in 2.2.40.Final.
Fixed in 2.2.40.Final (released Jun 27, 2026, 92 days after disclosure) and 2.3.25.Final (released Jun 27, 2026, 92 days after disclosure).
The latest release, 2.4.4.Final, is not affected.
- CVE-2026-28368High 8.7
Undertow: undertow: request smuggling via inconsistent header parsing
Affected: fixed in 2.2.40.Final; from 2.3.0.Final, fixed in 2.3.25.Final.
Fixed in 2.2.40.Final (released Jun 27, 2026, 92 days after disclosure) and 2.3.25.Final (released Jun 27, 2026, 92 days after disclosure).
The latest release, 2.4.4.Final, is not affected.
- CVE-2024-4027High 7.5
Undertow: outofmemoryerror in httpservletrequestimpl.getparameternames() can cause remote dos attacks
Affected: fixed in 2.2.39.Final; from 2.4.0.Alpha1, fixed in 2.4.0.Beta1; from 2.3.0.Alpha1, fixed in 2.3.21.Final.
Fixed in 2.2.39.Final (released Jan 31, 2026, 1 day after disclosure), 2.3.21.Final (released Jan 14, 2026, 16 days before disclosure) and 2.4.0.Beta1 (released Feb 19, 2026, 20 days after disclosure).
The latest release, 2.4.4.Final, is not affected.
- CVE-2025-12543Critical 9.6
Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf
Affected: versions 2.4.0.Alpha1; from 2.3.0.Alpha1, fixed in 2.3.21.Final; fixed in 2.2.39.Final.
Fixed in 2.2.39.Final (released Jan 31, 2026, 24 days after disclosure) and 2.3.21.Final (released Jan 14, 2026, 7 days after disclosure).
The latest release, 2.4.4.Final, is not affected.
- CVE-2024-3884High 7.5
Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded
Affected: fixed in 2.2.39.Final; from 2.4.0.Alpha1, fixed in 2.4.0.Beta1; from 2.3.0.Alpha1, fixed in 2.3.21.Final.
Fixed in 2.2.39.Final (released Jan 31, 2026, 59 days after disclosure), 2.3.21.Final (released Jan 14, 2026, 42 days after disclosure) and 2.4.0.Beta1 (released Feb 19, 2026, 78 days after disclosure).
The latest release, 2.4.4.Final, is not affected.
- CVE-2025-9784High 7.5
Undertow: undertow madeyoureset http/2 ddos vulnerability
Affected: fixed in 2.2.38.Final; from 2.3.0.Alpha1, fixed in 2.3.20.Final.
Fixed in 2.2.38.Final (released Oct 12, 2025, 40 days after disclosure) and 2.3.20.Final (released Oct 10, 2025, 38 days after disclosure).
The latest release, 2.4.4.Final, is not affected.
- CVE-2023-4639High 7.4
Undertow: cookie smuggling/spoofing
Affected: from 2.3.0.Alpha1, fixed in 2.3.11.Final; fixed in 2.2.30.Final.
Fixed in 2.2.30.Final (released Feb 14, 2024, 277 days before disclosure) and 2.3.11.Final (released Feb 14, 2024, 277 days before disclosure).
The latest release, 2.4.4.Final, is not affected.
- CVE-2023-1973High 7.5
Undertow: unrestricted request storage leads to memory exhaustion
Affected: fixed in 2.2.32.Final; from 2.3.0.Alpha1, fixed in 2.3.13.Final.
Fixed in 2.2.32.Final (released Apr 19, 2024, 202 days before disclosure) and 2.3.13.Final (released Apr 19, 2024, 202 days before disclosure).
The latest release, 2.4.4.Final, is not affected.
- CVE-2024-7885High 7.5
Undertow: improper state management in proxy protocol parsing causes information leakage
Affected: fixed in 2.2.36.Final; from 2.3.0.Alpha1, fixed in 2.3.17.Final.
Fixed in 2.2.36.Final (released Oct 1, 2024, 41 days after disclosure) and 2.3.17.Final (released Sep 1, 2024, 11 days after disclosure).
The latest release, 2.4.4.Final, is not affected.
- CVE-2024-3653Medium 5.3
Undertow: learningpushhandler can lead to remote memory dos attacks
Affected: from 2.3.0.Alpha1, fixed in 2.3.15.Final; fixed in 2.2.34.Final.
Fixed in 2.2.34.Final (released Aug 14, 2024, 37 days after disclosure) and 2.3.15.Final (released Jul 16, 2024, 8 days after disclosure).
The latest release, 2.4.4.Final, is not affected.
- CVE-2024-5971High 7.5
Undertow: response write hangs in case of java 17 tlsv1.3 newsessionticket
Affected: from 2.3.0.Alpha1, fixed in 2.3.15.Final; fixed in 2.2.34.Final.
Fixed in 2.2.34.Final (released Aug 14, 2024, 37 days after disclosure) and 2.3.15.Final (released Jul 16, 2024, 8 days after disclosure).
The latest release, 2.4.4.Final, is not affected.
- CVE-2024-6162High 7.5
Undertow: url-encoded request path information can be broken on ajp-listener
Affected: from 2.3.0.Alpha1, fixed in 2.3.14.Final; fixed in 2.2.33.Final.
Fixed in 2.2.33.Final (released Jun 23, 2024, 3 days after disclosure) and 2.3.14.Final (released Jun 20, 2024, the day of disclosure).
The latest release, 2.4.4.Final, is not affected.
- CVE-2024-1635High 7.5
Undertow: out-of-memory error after several closed connections with wildfly-http-client protocol
Affected: from 2.3.0.Final, fixed in 2.3.12.Final; fixed in 2.2.31.Final.
Fixed in 2.2.31.Final (released Mar 15, 2024, 25 days after disclosure) and 2.3.12.Final (released Feb 21, 2024, 2 days after disclosure).
The latest release, 2.4.4.Final, is not affected.
- CVE-2024-1459Medium 5.3
Undertow: directory traversal vulnerability
Affected: fixed in 2.2.31.Final; from 2.3.0.Alpha1, fixed in 2.3.12.Final.
Fixed in 2.2.31.Final (released Mar 15, 2024, 32 days after disclosure) and 2.3.12.Final (released Feb 21, 2024, 9 days after disclosure).
The latest release, 2.4.4.Final, is not affected.
Show all 41 advisoriesShow fewer advisories
- CVE-2023-1108High 7.5
Undertow: infinite loop in sslconduit during close
Affected: from 2.3.0, fixed in 2.3.5.Final; fixed in 2.2.24.Final.
Fixed in 2.2.24.Final (released Mar 31, 2023, 167 days before disclosure) and 2.3.5.Final (released Mar 26, 2023, 172 days before disclosure).
The latest release, 2.4.4.Final, is not affected.
- CVE-2022-4492Unrated
The undertow client is not checking the server identity presented by the server certificate in https connections.
Affected: from 2.3.0, fixed in 2.3.5.Final; fixed in 2.2.24.Final.
Fixed in 2.2.24.Final (released Mar 31, 2023, 36 days after disclosure) and 2.3.5.Final (released Mar 26, 2023, 31 days after disclosure).
The latest release, 2.4.4.Final, is not affected.
- CVE-2021-3859Unrated
A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2.
Affected: fixed in 2.2.15.
Fixed in 2.2.15.Final (released Feb 6, 2022, 201 days before disclosure).
The latest release, 2.4.4.Final, is not affected.
- CVE-2021-3690Unrated
A flaw was found in Undertow.
Affected: fixed in 2.0.40; from 2.2.0, fixed in 2.2.10.
Fixed in 2.0.40.Final (released Sep 28, 2021, 329 days before disclosure) and 2.2.10.Final (released Aug 10, 2021, 378 days before disclosure).
The latest release, 2.4.4.Final, is not affected.
- CVE-2022-2053Unrated
When a POST request comes through AJP and the request exceeds the max-post-size limit (maxEntitySize), Undertow's AjpServerRequestConduit…
Affected: fixed in 2.2.19.Final; from 2.3.0.Alpha1, fixed in 2.3.0.Alpha2.
Fixed in 2.2.19.Final (released Aug 11, 2022, 6 days after disclosure) and 2.3.0.Alpha2 (released Aug 3, 2022, 2 days before disclosure).
The latest release, 2.4.4.Final, is not affected.
- CVE-2021-3597Unrated
A flaw was found in undertow.
Affected: from 2.1.0, fixed in 2.2.9.Final; fixed in 2.0.39.Final.
Fixed in 2.0.39.Final (released Jul 20, 2021, 308 days before disclosure) and 2.2.9.Final (released Jul 20, 2021, 308 days before disclosure).
The latest release, 2.4.4.Final, is not affected.
- CVE-2021-3629Unrated
A flaw was found in Undertow.
Affected: fixed in 2.0.40.Final; from 2.1.0, fixed in 2.2.11.Final.
Fixed in 2.0.40.Final (released Sep 28, 2021, 238 days before disclosure) and 2.2.11.Final (released Sep 28, 2021, 238 days before disclosure).
The latest release, 2.4.4.Final, is not affected.
- CVE-2020-27782Unrated
A flaw was found in the Undertow AJP connector.
Affected: from 2.1.0, fixed in 2.1.5; fixed in 2.0.33.
Fixed in 2.0.33.Final (released Dec 7, 2020, 78 days before disclosure) and 2.1.5.Final (released Dec 7, 2020, 78 days before disclosure).
The latest release, 2.4.4.Final, is not affected.
- CVE-2021-20220Unrated
A flaw was found in Undertow.
Affected: from 2.1.0, fixed in 2.1.6; fixed in 2.0.34.
Fixed in 2.0.34.Final (released Feb 2, 2021, 21 days before disclosure) and 2.1.6.Final (released Feb 2, 2021, 21 days before disclosure).
The latest release, 2.4.4.Final, is not affected.
- CVE-2020-10687Unrated
A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is…
Affected: fixed in 2.2.0.Final.
Fixed in 2.2.0.Final (released Sep 14, 2020, 9 days before disclosure).
The latest release, 2.4.4.Final, is not affected.
- CVE-2020-10705Unrated
A flaw was discovered in Undertow in versions before Undertow 2.1.1.Final where certain requests to the "Expect: 100-continue" header may…
Affected: fixed in 2.1.1.Final.
Fixed in 2.1.1.Final (released May 15, 2020, 26 days before disclosure).
The latest release, 2.4.4.Final, is not affected.
- CVE-2020-10719Medium 6.5
A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes.
Affected: fixed in 2.1.1.Final.
Fixed in 2.1.1.Final (released May 15, 2020, 11 days before disclosure).
The latest release, 2.4.4.Final, is not affected.
- CVE-2020-1745High 8.6
A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version…
Affected: fixed in 2.0.30.
Fixed in 2.0.30.Final (released Mar 11, 2020, 48 days before disclosure).
The latest release, 2.4.4.Final, is not affected.
- CVE-2020-1757High 8.1
A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to…
Affected: fixed in 2.1.0.
Fixed in 2.1.0.Final (released Apr 18, 2020, 3 days before disclosure).
The latest release, 2.4.4.Final, is not affected.
- CVE-2019-14888High 7.5
A vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS.
Affected: fixed in 2.0.29.Final.
Fixed in 2.0.29.Final (released Jan 4, 2020, 19 days before disclosure).
The latest release, 2.4.4.Final, is not affected.
- CVE-2019-10212Medium 4.8
A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security.
Affected: fixed in 2.0.20.
Fixed in 2.0.20.Final (released Apr 4, 2019, 181 days before disclosure).
The latest release, 2.4.4.Final, is not affected.
- CVE-2019-3888Medium 5.3
A vulnerability was found in Undertow web server before 2.0.21.
Affected: fixed in 2.0.21.
Fixed in 2.0.21.Final (released May 24, 2019, 19 days before disclosure).
The latest release, 2.4.4.Final, is not affected.
- CVE-2018-14642Medium 5.3
An information leak vulnerability was found in Undertow.
Affected: fixed in 2.0.19.FINAL.
Fixed in 2.0.19.Final (released Feb 22, 2019, 157 days after disclosure).
The latest release, 2.4.4.Final, is not affected.
- CVE-2018-1114Medium 6.5
It was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized which can cause file…
Affected: fixed in 1.4.25.Final; from 2.0.0.Alpha1, fixed in 2.0.5.Final.
Fixed in 1.4.25.Final (released May 2, 2018, 132 days before disclosure) and 2.0.5.Final (released May 2, 2018, 132 days before disclosure).
The latest release, 2.4.4.Final, is not affected.
- CVE-2017-2670High 7.5
It was found in Undertow before 1.3.28 that with non-clean TCP close, the Websocket server gets into infinite loop on every IO thread…
Affected: fixed in 1.3.28.
Fixed in 1.3.28.Final (released Mar 20, 2017, 494 days before disclosure).
The latest release, 2.4.4.Final, is not affected.
- CVE-2017-12165Low 2.6
It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause…
Affected: fixed in 1.3.31; from 1.4.0, fixed in 1.4.17; from 2.0.0.Alpha1, fixed in 2.0.0.Beta1.
Fixed in 1.3.31.Final (released Aug 18, 2017, 343 days before disclosure), 1.4.17.Final (released Jun 26, 2017, 396 days before disclosure) and 2.0.0.Beta1 (released Feb 1, 2018, 176 days before disclosure).
The latest release, 2.4.4.Final, is not affected.
- CVE-2017-2666Medium 6.5
It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters.
Affected: fixed in 1.3.31; from 1.4.0, fixed in 1.4.17.
Fixed in 1.3.31.Final (released Aug 18, 2017, 343 days before disclosure) and 1.4.17.Final (released Jun 26, 2017, 396 days before disclosure).
The latest release, 2.4.4.Final, is not affected.
- CVE-2017-12196Medium 4.8
undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not…
Affected: from 2.0.0.Alpha1, fixed in 2.0.2.FInal; fixed in 1.4.24.Final.
Fixed in 1.4.24.Final (released Apr 12, 2018, 6 days before disclosure) and 2.0.2.Final (released Mar 16, 2018, 33 days before disclosure).
The latest release, 2.4.4.Final, is not affected.
- CVE-2017-7559Unrated
In Undertow 2.x before 2.0.0.Alpha2, 1.4.x before 1.4.17.Final, and 1.3.x before 1.3.31.Final, it was found that the fix for CVE-2017-2666…
Affected: from 1.4.0, fixed in 1.4.17.Final; from 1.3.0, fixed in 1.3.31.Final; from 2.0.0.Alpha1, fixed in 2.0.0.Alpha2.
Fixed in 1.3.31.Final (released Aug 18, 2017, 145 days before disclosure), 1.4.17.Final (released Jun 26, 2017, 198 days before disclosure) and 2.0.0.Final (released Feb 22, 2018, 43 days after disclosure, the advisory names 2.0.0.Alpha2, which was never published).
The latest release, 2.4.4.Final, is not affected.
- CVE-2016-7046Unrated
Red Hat JBoss Enterprise Application Platform (EAP) 7, when operating as a reverse-proxy with default buffer sizes, allows remote…
Affected: from 1.4.0, fixed in 1.4.3.Final; fixed in 1.3.25.Final.
Fixed in 1.3.25.Final (released Sep 16, 2016, 17 days before disclosure) and 1.4.3.Final (released Sep 15, 2016, 18 days before disclosure).
The latest release, 2.4.4.Final, is not affected.
- CVE-2014-7816Unrated
Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x before 1.1.0.CR5, and 1.2.x before 1.2.0.Beta3, when…
Affected: from 1.0.0, fixed in 1.0.17; from 1.1.0.Beta1, fixed in 1.1.0.CR5; from 1.2.0.Beta1, fixed in 1.2.0.Beta3.
Fixed in 1.0.17.Final (released Oct 28, 2014, 34 days before disclosure), 1.1.0.CR5 (released Oct 21, 2014, 41 days before disclosure) and 1.2.0.Beta3 (released Oct 28, 2014, 34 days before disclosure).
The latest release, 2.4.4.Final, is not affected.