Search for packages
| purl | pkg:maven/io.undertow/undertow-core@2.3.2.Final |
| Next non-vulnerable version | 2.3.20.Final |
| Latest non-vulnerable version | 2.4.0.Beta1 |
| Risk | 4.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-1vrj-chs2-d3ab
Aliases: CVE-2023-1973 GHSA-97cq-f4jm-mv8h |
Undertow Denial of Service vulnerability A flaw was found in Undertow package. Using the FormAuthenticationMechanism, a malicious user could trigger a Denial of Service by sending crafted requests, leading the server to an OutofMemory error, exhausting the server's memory. |
Affected by 2 other vulnerabilities. |
|
VCID-2cv5-9v62-kfbm
Aliases: CVE-2024-1459 GHSA-v76w-3ph8-vm66 |
Undertow Path Traversal vulnerability A path traversal vulnerability was found in Undertow. This issue may allow a remote attacker to append a specially-crafted sequence to an HTTP request for an application deployed to JBoss EAP, which may permit access to privileged or restricted files and directories. |
Affected by 3 other vulnerabilities. |
|
VCID-5585-a76n-zubf
Aliases: CVE-2023-5379 |
Allocation of Resources Without Limits or Throttling A flaw was found in Undertow. When an AJP request is sent that exceeds the max-header-size attribute in ajp-listener, JBoss EAP is marked in an error state by mod_cluster in httpd, causing JBoss EAP to close the TCP connection without returning an AJP response. This happens because mod_proxy_cluster marks the JBoss EAP instance as an error worker when the TCP connection is closed from the backend after sending the AJP request without receiving an AJP response, and stops forwarding. This issue could allow a malicious user could to repeatedly send requests that exceed the max-header-size, causing a Denial of Service (DoS). |
Affected by 4 other vulnerabilities. |
|
VCID-ns3p-22xg-q3bz
Aliases: CVE-2025-9784 GHSA-95h4-w6j8-2rp8 |
Undertow MadeYouReset HTTP/2 DDoS Vulnerability A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS). |
Affected by 0 other vulnerabilities. |
|
VCID-usz2-tufg-k7gz
Aliases: CVE-2023-1108 GHSA-m4mm-pg93-fv78 |
Undertow denial of service vulnerability A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates. |
Affected by 5 other vulnerabilities. |
|
VCID-xme8-usmd-vqg3
Aliases: CVE-2024-7885 GHSA-9623-mqmm-5rcf |
Undertow vulnerable to Race Condition A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a result, different requests may share the same StringBuilder instance, potentially leading to information leakage between requests or responses. In some cases, a value from a previous request or response may be erroneously reused, which could lead to unintended data exposure. This issue primarily results in errors and connection termination but creates a risk of data leakage in multi-request environments. |
Affected by 1 other vulnerability. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||