# io.undertow:undertow-core (Maven) vulnerabilities 41 known vulnerabilities (1 critical, 17 high, 9 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 2.4.4.Final (Oct 3, 2026): no advisory affects it - Newest unaffected release: 2.4.4.Final (Oct 3, 2026), the latest release - Dependents: 323 - Releases: 353 since 1.0.0.Final (Feb 10, 2014) - Registry: https://central.sonatype.com/artifact/io.undertow/undertow-core - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-28369: 1.0.0.Alpha1 to 2.2.39.Final (2.2.40.Final is outside it); 2.3.0.Final to 2.3.24.Final (2.3.25.Final is outside it) - CVE-2026-28367: 1.0.0.Alpha1 to 2.2.39.Final (2.2.40.Final is outside it); 2.3.0.Final to 2.3.24.Final (2.3.25.Final is outside it) - CVE-2026-28368: 1.0.0.Alpha1 to 2.2.39.Final (2.2.40.Final is outside it); 2.3.0.Final to 2.3.24.Final (2.3.25.Final is outside it) - CVE-2024-4027: 1.0.0.Alpha1 to 2.2.38.Final (2.2.39.Final is outside it); 2.3.0.Alpha1 to 2.3.20.Final (2.3.21.Final is outside it); 2.4.0.Alpha1 (2.4.0.Beta1 is outside it) - CVE-2025-12543: 1.0.0.Alpha1 to 2.2.38.Final (2.2.39.Final is outside it); 2.3.0.Alpha1 to 2.3.20.Final (2.3.21.Final is outside it); 2.4.0.Alpha1 (2.4.0.Beta1 is outside it) - CVE-2024-3884: 1.0.0.Alpha1 to 2.2.38.Final (2.2.39.Final is outside it); 2.3.0.Alpha1 to 2.3.20.Final (2.3.21.Final is outside it); 2.4.0.Alpha1 (2.4.0.Beta1 is outside it) - CVE-2025-9784: 1.0.0.Alpha1 to 2.2.37.Final (2.2.38.Final is outside it); 2.3.0.Alpha1 to 2.3.19.Final (2.3.20.Final is outside it) - CVE-2023-4639: 1.0.0.Alpha1 to 2.2.29.Final (2.2.30.Final is outside it); 2.3.0.Alpha1 to 2.3.10.Final (2.3.11.Final is outside it) - CVE-2023-1973: 1.0.0.Alpha1 to 2.2.31.Final (2.2.32.Final is outside it); 2.3.0.Alpha1 to 2.3.12.Final (2.3.13.Final is outside it) - CVE-2024-7885: 1.0.0.Alpha1 to 2.2.35.Final (2.2.36.Final is outside it); 2.3.0.Alpha1 to 2.3.16.Final (2.3.17.Final is outside it) - CVE-2024-3653: 1.0.0.Alpha1 to 2.2.33.Final (2.2.34.Final is outside it); 2.3.0.Alpha1 to 2.3.14.Final (2.3.15.Final is outside it) - CVE-2024-5971: 1.0.0.Alpha1 to 2.2.33.Final (2.2.34.Final is outside it); 2.3.0.Alpha1 to 2.3.14.Final (2.3.15.Final is outside it) - CVE-2024-6162: 1.0.0.Alpha1 to 2.2.32.Final (2.2.33.Final is outside it); 2.3.0.Alpha1 to 2.3.13.Final (2.3.14.Final is outside it) - CVE-2024-1635: 1.0.0.Alpha1 to 2.2.30.Final (2.2.31.Final is outside it); 2.3.0.Final to 2.3.11.Final (2.3.12.Final is outside it) - CVE-2024-1459: 1.0.0.Alpha1 to 2.2.30.Final (2.2.31.Final is outside it); 2.3.0.Alpha1 to 2.3.11.Final (2.3.12.Final is outside it) - CVE-2023-1108: 1.0.0.Alpha1 to 2.2.23.Final (2.2.24.Final is outside it); 2.3.0.Final to 2.3.4.Final (2.3.5.Final is outside it) - CVE-2022-4492: 1.0.0.Alpha1 to 2.2.23.Final (2.2.24.Final is outside it); 2.3.0.Final to 2.3.4.Final (2.3.5.Final is outside it) - CVE-2021-3859: 1.0.0.Alpha1 to 2.2.14.Final (2.2.15.Final is outside it) - CVE-2021-3690: 1.0.0.Alpha1 to 2.0.39.Final (2.0.40.Final is outside it); 2.2.0.Final to 2.2.9.Final (2.2.10.Final is outside it) - CVE-2022-2053: 1.0.0.Alpha1 to 2.2.18.Final (2.2.19.Final is outside it); 2.3.0.Alpha1 (2.3.0.Alpha2 is outside it) - CVE-2021-3597: 1.0.0.Alpha1 to 2.0.38.Final (2.0.39.Final is outside it); 2.1.0.Final to 2.2.8.Final (2.2.9.Final is outside it) - CVE-2021-3629: 1.0.0.Alpha1 to 2.0.39.Final (2.0.40.Final is outside it); 2.1.0.Final to 2.2.10.Final (2.2.11.Final is outside it) - CVE-2020-27782: 1.0.0.Alpha1 to 2.0.32.Final (2.0.33.Final is outside it); 2.1.0.Final to 2.1.4.Final (2.1.5.Final is outside it) - CVE-2021-20220: 1.0.0.Alpha1 to 2.0.33.Final (2.0.34.Final is outside it); 2.1.0.Final to 2.1.5.Final (2.1.6.Final is outside it) - CVE-2020-10687: 1.0.0.Alpha1 to 2.1.8.Final (2.2.0.Final is outside it) - CVE-2020-10705: 1.0.0.Alpha1 to 2.1.0.Final (2.1.1.Final is outside it) - CVE-2020-10719: 1.0.0.Alpha1 to 2.1.0.Final (2.1.1.Final is outside it) - CVE-2020-1745: 1.0.0.Alpha1 to 2.0.29.Final (2.0.30.Final is outside it) - CVE-2020-1757: 1.0.0.Alpha1 to 2.0.42.Final (2.1.0.Final is outside it) - CVE-2019-14888: 1.0.0.Alpha1 to 2.0.28.Final (2.0.29.Final is outside it) - CVE-2019-10212: 1.0.0.Alpha1 to 2.0.19.Final (2.0.20.Final is outside it) - CVE-2019-3888: 1.0.0.Alpha1 to 2.0.20.Final (2.0.21.Final is outside it) - CVE-2018-14642: 1.0.0.Alpha1 to 2.0.18.Final (2.0.19.Final is outside it) - CVE-2018-1114: 1.0.0.Alpha1 to 1.4.24.Final (1.4.25.Final is outside it); 2.0.0.Alpha1 to 2.0.4.Final (2.0.5.Final is outside it) - CVE-2017-2670: 1.0.0.Alpha1 to 1.3.27.Final (1.3.28.Final is outside it) - CVE-2017-12165: 1.0.0.Alpha1 to 1.3.30.Final (1.3.31.Final is outside it); 1.4.0.Final to 1.4.16.Final (1.4.17.Final is outside it); 2.0.0.Alpha1 (2.0.0.Beta1 is outside it) - CVE-2017-2666: 1.0.0.Alpha1 to 1.3.30.Final (1.3.31.Final is outside it); 1.4.0.Final to 1.4.16.Final (1.4.17.Final is outside it) - CVE-2017-12196: 1.0.0.Alpha1 to 1.4.23.Final (1.4.24.Final is outside it); 2.0.0.Alpha1 to 2.0.1.Final (2.0.2.Final is outside it) - CVE-2017-7559: 1.3.0.Final to 1.3.30.Final (1.3.31.Final is outside it); 1.4.0.Final to 1.4.16.Final (1.4.17.Final is outside it); 2.0.0.Alpha1 (2.0.0.Beta1 is outside it) - CVE-2016-7046: 1.0.0.Alpha1 to 1.3.24.Final (1.3.25.Final is outside it); 1.4.0.Final to 1.4.2.Final (1.4.3.Final is outside it) - CVE-2014-7816: 1.0.0.Final to 1.0.16.Final (1.0.17.Final is outside it); 1.1.0.Beta1 to 1.1.0.CR4 (1.1.0.CR5 is outside it); 1.2.0.Beta1 to 1.2.0.Beta2 (1.2.0.Beta3 is outside it) ## Advisories (41) ### [CVE-2026-28369](https://cve.now/CVE-2026-28369): Undertow: undertow: request smuggling via malformed http request headers - Severity: High 8.7 - Published: Mar 27, 2026 - Affected: fixed in 2.2.40.Final; from 2.3.0.Final, fixed in 2.3.25.Final. - Fixed in 2.2.40.Final (released Jun 27, 2026, 92 days after disclosure) and 2.3.25.Final (released Jun 27, 2026, 92 days after disclosure). - The latest release, 2.4.4.Final, is not affected. ### [CVE-2026-28367](https://cve.now/CVE-2026-28367): Undertow: undertow: request smuggling via \`\\r\\r\\r\` as a header block terminator - Severity: High 8.7 - Published: Mar 27, 2026 - Affected: from 2.3.0.Final, fixed in 2.3.25.Final; fixed in 2.2.40.Final. - Fixed in 2.2.40.Final (released Jun 27, 2026, 92 days after disclosure) and 2.3.25.Final (released Jun 27, 2026, 92 days after disclosure). - The latest release, 2.4.4.Final, is not affected. ### [CVE-2026-28368](https://cve.now/CVE-2026-28368): Undertow: undertow: request smuggling via inconsistent header parsing - Severity: High 8.7 - Published: Mar 27, 2026 - Affected: fixed in 2.2.40.Final; from 2.3.0.Final, fixed in 2.3.25.Final. - Fixed in 2.2.40.Final (released Jun 27, 2026, 92 days after disclosure) and 2.3.25.Final (released Jun 27, 2026, 92 days after disclosure). - The latest release, 2.4.4.Final, is not affected. ### [CVE-2024-4027](https://cve.now/CVE-2024-4027): Undertow: outofmemoryerror in httpservletrequestimpl.getparameternames() can cause remote dos attacks - Severity: High 7.5 - Published: Jan 30, 2026 - Affected: fixed in 2.2.39.Final; from 2.4.0.Alpha1, fixed in 2.4.0.Beta1; from 2.3.0.Alpha1, fixed in 2.3.21.Final. - Fixed in 2.2.39.Final (released Jan 31, 2026, 1 day after disclosure), 2.3.21.Final (released Jan 14, 2026, 16 days before disclosure) and 2.4.0.Beta1 (released Feb 19, 2026, 20 days after disclosure). - The latest release, 2.4.4.Final, is not affected. ### [CVE-2025-12543](https://cve.now/CVE-2025-12543): Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf - Severity: Critical 9.6 - Published: Jan 7, 2026 - Affected: versions 2.4.0.Alpha1; from 2.3.0.Alpha1, fixed in 2.3.21.Final; fixed in 2.2.39.Final. - Fixed in 2.2.39.Final (released Jan 31, 2026, 24 days after disclosure) and 2.3.21.Final (released Jan 14, 2026, 7 days after disclosure). - The latest release, 2.4.4.Final, is not affected. ### [CVE-2024-3884](https://cve.now/CVE-2024-3884): Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded - Severity: High 7.5 - Published: Dec 3, 2025 - Affected: fixed in 2.2.39.Final; from 2.4.0.Alpha1, fixed in 2.4.0.Beta1; from 2.3.0.Alpha1, fixed in 2.3.21.Final. - Fixed in 2.2.39.Final (released Jan 31, 2026, 59 days after disclosure), 2.3.21.Final (released Jan 14, 2026, 42 days after disclosure) and 2.4.0.Beta1 (released Feb 19, 2026, 78 days after disclosure). - The latest release, 2.4.4.Final, is not affected. ### [CVE-2025-9784](https://cve.now/CVE-2025-9784): Undertow: undertow madeyoureset http/2 ddos vulnerability - Severity: High 7.5 - Published: Sep 2, 2025 - Affected: fixed in 2.2.38.Final; from 2.3.0.Alpha1, fixed in 2.3.20.Final. - Fixed in 2.2.38.Final (released Oct 12, 2025, 40 days after disclosure) and 2.3.20.Final (released Oct 10, 2025, 38 days after disclosure). - The latest release, 2.4.4.Final, is not affected. ### [CVE-2023-4639](https://cve.now/CVE-2023-4639): Undertow: cookie smuggling/spoofing - Severity: High 7.4 - Published: Nov 17, 2024 - Affected: from 2.3.0.Alpha1, fixed in 2.3.11.Final; fixed in 2.2.30.Final. - Fixed in 2.2.30.Final (released Feb 14, 2024, 277 days before disclosure) and 2.3.11.Final (released Feb 14, 2024, 277 days before disclosure). - The latest release, 2.4.4.Final, is not affected. ### [CVE-2023-1973](https://cve.now/CVE-2023-1973): Undertow: unrestricted request storage leads to memory exhaustion - Severity: High 7.5 - Published: Nov 7, 2024 - Affected: fixed in 2.2.32.Final; from 2.3.0.Alpha1, fixed in 2.3.13.Final. - Fixed in 2.2.32.Final (released Apr 19, 2024, 202 days before disclosure) and 2.3.13.Final (released Apr 19, 2024, 202 days before disclosure). - The latest release, 2.4.4.Final, is not affected. ### [CVE-2024-7885](https://cve.now/CVE-2024-7885): Undertow: improper state management in proxy protocol parsing causes information leakage - Severity: High 7.5 - Published: Aug 21, 2024 - Affected: fixed in 2.2.36.Final; from 2.3.0.Alpha1, fixed in 2.3.17.Final. - Fixed in 2.2.36.Final (released Oct 1, 2024, 41 days after disclosure) and 2.3.17.Final (released Sep 1, 2024, 11 days after disclosure). - The latest release, 2.4.4.Final, is not affected. ### [CVE-2024-3653](https://cve.now/CVE-2024-3653): Undertow: learningpushhandler can lead to remote memory dos attacks - Severity: Medium 5.3 - Published: Jul 8, 2024 - Affected: from 2.3.0.Alpha1, fixed in 2.3.15.Final; fixed in 2.2.34.Final. - Fixed in 2.2.34.Final (released Aug 14, 2024, 37 days after disclosure) and 2.3.15.Final (released Jul 16, 2024, 8 days after disclosure). - The latest release, 2.4.4.Final, is not affected. ### [CVE-2024-5971](https://cve.now/CVE-2024-5971): Undertow: response write hangs in case of java 17 tlsv1.3 newsessionticket - Severity: High 7.5 - Published: Jul 8, 2024 - Affected: from 2.3.0.Alpha1, fixed in 2.3.15.Final; fixed in 2.2.34.Final. - Fixed in 2.2.34.Final (released Aug 14, 2024, 37 days after disclosure) and 2.3.15.Final (released Jul 16, 2024, 8 days after disclosure). - The latest release, 2.4.4.Final, is not affected. ### [CVE-2024-6162](https://cve.now/CVE-2024-6162): Undertow: url-encoded request path information can be broken on ajp-listener - Severity: High 7.5 - Published: Jun 20, 2024 - Affected: from 2.3.0.Alpha1, fixed in 2.3.14.Final; fixed in 2.2.33.Final. - Fixed in 2.2.33.Final (released Jun 23, 2024, 3 days after disclosure) and 2.3.14.Final (released Jun 20, 2024, the day of disclosure). - The latest release, 2.4.4.Final, is not affected. ### [CVE-2024-1635](https://cve.now/CVE-2024-1635): Undertow: out-of-memory error after several closed connections with wildfly-http-client protocol - Severity: High 7.5 - Published: Feb 19, 2024 - Affected: from 2.3.0.Final, fixed in 2.3.12.Final; fixed in 2.2.31.Final. - Fixed in 2.2.31.Final (released Mar 15, 2024, 25 days after disclosure) and 2.3.12.Final (released Feb 21, 2024, 2 days after disclosure). - The latest release, 2.4.4.Final, is not affected. ### [CVE-2024-1459](https://cve.now/CVE-2024-1459): Undertow: directory traversal vulnerability - Severity: Medium 5.3 - Published: Feb 12, 2024 - Affected: fixed in 2.2.31.Final; from 2.3.0.Alpha1, fixed in 2.3.12.Final. - Fixed in 2.2.31.Final (released Mar 15, 2024, 32 days after disclosure) and 2.3.12.Final (released Feb 21, 2024, 9 days after disclosure). - The latest release, 2.4.4.Final, is not affected. ### [CVE-2023-1108](https://cve.now/CVE-2023-1108): Undertow: infinite loop in sslconduit during close - Severity: High 7.5 - Published: Sep 14, 2023 - Affected: from 2.3.0, fixed in 2.3.5.Final; fixed in 2.2.24.Final. - Fixed in 2.2.24.Final (released Mar 31, 2023, 167 days before disclosure) and 2.3.5.Final (released Mar 26, 2023, 172 days before disclosure). - The latest release, 2.4.4.Final, is not affected. ### [CVE-2022-4492](https://cve.now/CVE-2022-4492): The undertow client is not checking the server identity presented by the server certificate in https connections. - Severity: Unrated - Published: Feb 23, 2023 - Affected: from 2.3.0, fixed in 2.3.5.Final; fixed in 2.2.24.Final. - Fixed in 2.2.24.Final (released Mar 31, 2023, 36 days after disclosure) and 2.3.5.Final (released Mar 26, 2023, 31 days after disclosure). - The latest release, 2.4.4.Final, is not affected. ### [CVE-2021-3859](https://cve.now/CVE-2021-3859): A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. - Severity: Unrated - Published: Aug 26, 2022 - Affected: fixed in 2.2.15. - Fixed in 2.2.15.Final (released Feb 6, 2022, 201 days before disclosure). - The latest release, 2.4.4.Final, is not affected. ### [CVE-2021-3690](https://cve.now/CVE-2021-3690): A flaw was found in Undertow. - Severity: Unrated - Published: Aug 23, 2022 - Affected: fixed in 2.0.40; from 2.2.0, fixed in 2.2.10. - Fixed in 2.0.40.Final (released Sep 28, 2021, 329 days before disclosure) and 2.2.10.Final (released Aug 10, 2021, 378 days before disclosure). - The latest release, 2.4.4.Final, is not affected. ### [CVE-2022-2053](https://cve.now/CVE-2022-2053): When a POST request comes through AJP and the request exceeds the max-post-size limit (maxEntitySize), Undertow's AjpServerRequestConduit… - Severity: Unrated - Published: Aug 5, 2022 - Affected: fixed in 2.2.19.Final; from 2.3.0.Alpha1, fixed in 2.3.0.Alpha2. - Fixed in 2.2.19.Final (released Aug 11, 2022, 6 days after disclosure) and 2.3.0.Alpha2 (released Aug 3, 2022, 2 days before disclosure). - The latest release, 2.4.4.Final, is not affected. ### [CVE-2021-3597](https://cve.now/CVE-2021-3597): A flaw was found in undertow. - Severity: Unrated - Published: May 24, 2022 - Affected: from 2.1.0, fixed in 2.2.9.Final; fixed in 2.0.39.Final. - Fixed in 2.0.39.Final (released Jul 20, 2021, 308 days before disclosure) and 2.2.9.Final (released Jul 20, 2021, 308 days before disclosure). - The latest release, 2.4.4.Final, is not affected. ### [CVE-2021-3629](https://cve.now/CVE-2021-3629): A flaw was found in Undertow. - Severity: Unrated - Published: May 24, 2022 - Affected: fixed in 2.0.40.Final; from 2.1.0, fixed in 2.2.11.Final. - Fixed in 2.0.40.Final (released Sep 28, 2021, 238 days before disclosure) and 2.2.11.Final (released Sep 28, 2021, 238 days before disclosure). - The latest release, 2.4.4.Final, is not affected. ### [CVE-2020-27782](https://cve.now/CVE-2020-27782): A flaw was found in the Undertow AJP connector. - Severity: Unrated - Published: Feb 23, 2021 - Affected: from 2.1.0, fixed in 2.1.5; fixed in 2.0.33. - Fixed in 2.0.33.Final (released Dec 7, 2020, 78 days before disclosure) and 2.1.5.Final (released Dec 7, 2020, 78 days before disclosure). - The latest release, 2.4.4.Final, is not affected. ### [CVE-2021-20220](https://cve.now/CVE-2021-20220): A flaw was found in Undertow. - Severity: Unrated - Published: Feb 23, 2021 - Affected: from 2.1.0, fixed in 2.1.6; fixed in 2.0.34. - Fixed in 2.0.34.Final (released Feb 2, 2021, 21 days before disclosure) and 2.1.6.Final (released Feb 2, 2021, 21 days before disclosure). - The latest release, 2.4.4.Final, is not affected. ### [CVE-2020-10687](https://cve.now/CVE-2020-10687): A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is… - Severity: Unrated - Published: Sep 23, 2020 - Affected: fixed in 2.2.0.Final. - Fixed in 2.2.0.Final (released Sep 14, 2020, 9 days before disclosure). - The latest release, 2.4.4.Final, is not affected. ### [CVE-2020-10705](https://cve.now/CVE-2020-10705): A flaw was discovered in Undertow in versions before Undertow 2.1.1.Final where certain requests to the "Expect: 100-continue" header may… - Severity: Unrated - Published: Jun 10, 2020 - Affected: fixed in 2.1.1.Final. - Fixed in 2.1.1.Final (released May 15, 2020, 26 days before disclosure). - The latest release, 2.4.4.Final, is not affected. ### [CVE-2020-10719](https://cve.now/CVE-2020-10719): A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes. - Severity: Medium 6.5 - Published: May 26, 2020 - Affected: fixed in 2.1.1.Final. - Fixed in 2.1.1.Final (released May 15, 2020, 11 days before disclosure). - The latest release, 2.4.4.Final, is not affected. ### [CVE-2020-1745](https://cve.now/CVE-2020-1745): A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version… - Severity: High 8.6 - Published: Apr 28, 2020 - Affected: fixed in 2.0.30. - Fixed in 2.0.30.Final (released Mar 11, 2020, 48 days before disclosure). - The latest release, 2.4.4.Final, is not affected. ### [CVE-2020-1757](https://cve.now/CVE-2020-1757): A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to… - Severity: High 8.1 - Published: Apr 21, 2020 - Affected: fixed in 2.1.0. - Fixed in 2.1.0.Final (released Apr 18, 2020, 3 days before disclosure). - The latest release, 2.4.4.Final, is not affected. ### [CVE-2019-14888](https://cve.now/CVE-2019-14888): A vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS. - Severity: High 7.5 - Published: Jan 23, 2020 - Affected: fixed in 2.0.29.Final. - Fixed in 2.0.29.Final (released Jan 4, 2020, 19 days before disclosure). - The latest release, 2.4.4.Final, is not affected. ### [CVE-2019-10212](https://cve.now/CVE-2019-10212): A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. - Severity: Medium 4.8 - Published: Oct 2, 2019 - Affected: fixed in 2.0.20. - Fixed in 2.0.20.Final (released Apr 4, 2019, 181 days before disclosure). - The latest release, 2.4.4.Final, is not affected. ### [CVE-2019-3888](https://cve.now/CVE-2019-3888): A vulnerability was found in Undertow web server before 2.0.21. - Severity: Medium 5.3 - Published: Jun 12, 2019 - Affected: fixed in 2.0.21. - Fixed in 2.0.21.Final (released May 24, 2019, 19 days before disclosure). - The latest release, 2.4.4.Final, is not affected. ### [CVE-2018-14642](https://cve.now/CVE-2018-14642): An information leak vulnerability was found in Undertow. - Severity: Medium 5.3 - Published: Sep 18, 2018 - Affected: fixed in 2.0.19.FINAL. - Fixed in 2.0.19.Final (released Feb 22, 2019, 157 days after disclosure). - The latest release, 2.4.4.Final, is not affected. ### [CVE-2018-1114](https://cve.now/CVE-2018-1114): It was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized which can cause file… - Severity: Medium 6.5 - Published: Sep 11, 2018 - Affected: fixed in 1.4.25.Final; from 2.0.0.Alpha1, fixed in 2.0.5.Final. - Fixed in 1.4.25.Final (released May 2, 2018, 132 days before disclosure) and 2.0.5.Final (released May 2, 2018, 132 days before disclosure). - The latest release, 2.4.4.Final, is not affected. ### [CVE-2017-2670](https://cve.now/CVE-2017-2670): It was found in Undertow before 1.3.28 that with non-clean TCP close, the Websocket server gets into infinite loop on every IO thread… - Severity: High 7.5 - Published: Jul 27, 2018 - Affected: fixed in 1.3.28. - Fixed in 1.3.28.Final (released Mar 20, 2017, 494 days before disclosure). - The latest release, 2.4.4.Final, is not affected. ### [CVE-2017-12165](https://cve.now/CVE-2017-12165): It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause… - Severity: Low 2.6 - Published: Jul 27, 2018 - Affected: fixed in 1.3.31; from 1.4.0, fixed in 1.4.17; from 2.0.0.Alpha1, fixed in 2.0.0.Beta1. - Fixed in 1.3.31.Final (released Aug 18, 2017, 343 days before disclosure), 1.4.17.Final (released Jun 26, 2017, 396 days before disclosure) and 2.0.0.Beta1 (released Feb 1, 2018, 176 days before disclosure). - The latest release, 2.4.4.Final, is not affected. ### [CVE-2017-2666](https://cve.now/CVE-2017-2666): It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters. - Severity: Medium 6.5 - Published: Jul 27, 2018 - Affected: fixed in 1.3.31; from 1.4.0, fixed in 1.4.17. - Fixed in 1.3.31.Final (released Aug 18, 2017, 343 days before disclosure) and 1.4.17.Final (released Jun 26, 2017, 396 days before disclosure). - The latest release, 2.4.4.Final, is not affected. ### [CVE-2017-12196](https://cve.now/CVE-2017-12196): undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not… - Severity: Medium 4.8 - Published: Apr 18, 2018 - Affected: from 2.0.0.Alpha1, fixed in 2.0.2.FInal; fixed in 1.4.24.Final. - Fixed in 1.4.24.Final (released Apr 12, 2018, 6 days before disclosure) and 2.0.2.Final (released Mar 16, 2018, 33 days before disclosure). - The latest release, 2.4.4.Final, is not affected. ### [CVE-2017-7559](https://cve.now/CVE-2017-7559): In Undertow 2.x before 2.0.0.Alpha2, 1.4.x before 1.4.17.Final, and 1.3.x before 1.3.31.Final, it was found that the fix for CVE-2017-2666… - Severity: Unrated - Published: Jan 10, 2018 - Affected: from 1.4.0, fixed in 1.4.17.Final; from 1.3.0, fixed in 1.3.31.Final; from 2.0.0.Alpha1, fixed in 2.0.0.Alpha2. - Fixed in 1.3.31.Final (released Aug 18, 2017, 145 days before disclosure), 1.4.17.Final (released Jun 26, 2017, 198 days before disclosure) and 2.0.0.Final (released Feb 22, 2018, 43 days after disclosure, the advisory names 2.0.0.Alpha2, which was never published). - The latest release, 2.4.4.Final, is not affected. ### [CVE-2016-7046](https://cve.now/CVE-2016-7046): Red Hat JBoss Enterprise Application Platform (EAP) 7, when operating as a reverse-proxy with default buffer sizes, allows remote… - Severity: Unrated - Published: Oct 3, 2016 - Affected: from 1.4.0, fixed in 1.4.3.Final; fixed in 1.3.25.Final. - Fixed in 1.3.25.Final (released Sep 16, 2016, 17 days before disclosure) and 1.4.3.Final (released Sep 15, 2016, 18 days before disclosure). - The latest release, 2.4.4.Final, is not affected. ### [CVE-2014-7816](https://cve.now/CVE-2014-7816): Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x before 1.1.0.CR5, and 1.2.x before 1.2.0.Beta3, when… - Severity: Unrated - Published: Dec 1, 2014 - Affected: from 1.0.0, fixed in 1.0.17; from 1.1.0.Beta1, fixed in 1.1.0.CR5; from 1.2.0.Beta1, fixed in 1.2.0.Beta3. - Fixed in 1.0.17.Final (released Oct 28, 2014, 34 days before disclosure), 1.1.0.CR5 (released Oct 21, 2014, 41 days before disclosure) and 1.2.0.Beta3 (released Oct 28, 2014, 34 days before disclosure). - The latest release, 2.4.4.Final, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/io.undertow:undertow-core Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.