Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-beaj-uk9m-17be
Vulnerability ID VCID-beaj-uk9m-17be
Aliases CVE-2020-27782
GHSA-rhcw-wjcm-9h6g
Summary Denial of service in Undertow A flaw was found in the Undertow AJP connector. Malicious requests and abrupt connection closes could be triggered by an attacker using query strings with non-RFC compliant characters resulting in a denial of service. The highest threat from this vulnerability is to system availability. This affects Undertow 2.1.5.SP1, 2.0.33.SP2, and 2.2.3.SP1.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-400 Uncontrolled Resource Consumption
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-27782.json
epss 0.00182 https://api.first.org/data/v1/epss?cve=CVE-2020-27782
epss 0.00182 https://api.first.org/data/v1/epss?cve=CVE-2020-27782
epss 0.00182 https://api.first.org/data/v1/epss?cve=CVE-2020-27782
epss 0.00182 https://api.first.org/data/v1/epss?cve=CVE-2020-27782
epss 0.00182 https://api.first.org/data/v1/epss?cve=CVE-2020-27782
epss 0.00182 https://api.first.org/data/v1/epss?cve=CVE-2020-27782
epss 0.00182 https://api.first.org/data/v1/epss?cve=CVE-2020-27782
epss 0.00182 https://api.first.org/data/v1/epss?cve=CVE-2020-27782
epss 0.00182 https://api.first.org/data/v1/epss?cve=CVE-2020-27782
cvssv3.1 7.5 https://bugzilla.redhat.com/show_bug.cgi?id=1901304
generic_textual HIGH https://bugzilla.redhat.com/show_bug.cgi?id=1901304
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-rhcw-wjcm-9h6g
cvssv3.1 7.5 https://github.com/undertow-io/undertow/pull/997/commits/98a9ab7f2d7fe7a7254eaf17d47816c452169c90
generic_textual HIGH https://github.com/undertow-io/undertow/pull/997/commits/98a9ab7f2d7fe7a7254eaf17d47816c452169c90
cvssv3.1 7.5 https://issues.redhat.com/browse/UNDERTOW-1813
generic_textual HIGH https://issues.redhat.com/browse/UNDERTOW-1813
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2020-27782
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2020-27782
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-27782.json
https://api.first.org/data/v1/epss?cve=CVE-2020-27782
https://bugzilla.redhat.com/show_bug.cgi?id=1901304
https://github.com/undertow-io/undertow/pull/997/commits/98a9ab7f2d7fe7a7254eaf17d47816c452169c90
https://issues.redhat.com/browse/UNDERTOW-1813
https://nvd.nist.gov/vuln/detail/CVE-2020-27782
GHSA-rhcw-wjcm-9h6g https://github.com/advisories/GHSA-rhcw-wjcm-9h6g
RHSA-2021:0246 https://access.redhat.com/errata/RHSA-2021:0246
RHSA-2021:0247 https://access.redhat.com/errata/RHSA-2021:0247
RHSA-2021:0248 https://access.redhat.com/errata/RHSA-2021:0248
RHSA-2021:0250 https://access.redhat.com/errata/RHSA-2021:0250
RHSA-2021:0295 https://access.redhat.com/errata/RHSA-2021:0295
RHSA-2021:0327 https://access.redhat.com/errata/RHSA-2021:0327
RHSA-2021:3205 https://access.redhat.com/errata/RHSA-2021:3205
RHSA-2021:3207 https://access.redhat.com/errata/RHSA-2021:3207
RHSA-2021:3425 https://access.redhat.com/errata/RHSA-2021:3425
RHSA-2021:5134 https://access.redhat.com/errata/RHSA-2021:5134
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-27782.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://bugzilla.redhat.com/show_bug.cgi?id=1901304
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/undertow-io/undertow/pull/997/commits/98a9ab7f2d7fe7a7254eaf17d47816c452169c90
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://issues.redhat.com/browse/UNDERTOW-1813
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2020-27782
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.39751
EPSS Score 0.00182
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:06:05.075967+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-rhcw-wjcm-9h6g/GHSA-rhcw-wjcm-9h6g.json 38.0.0