Package Instance

Uncontrolled Resource Consumption
A vulnerability was found in the Undertow HTTP server when listening on HTTPS. An attacker can target the HTTPS port to carry out a Denial Of Service (DOS) to make the service unavailable on SSL.

Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling)
A flaw was found in Undertow, regarding the processing of invalid HTTP requests with large chunk sizes. This flaw allows an attacker to take advantage of HTTP request smuggling.

Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling)
A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possible against `HTTP/1.x` and `HTTP/2` due to permitting invalid characters in an HTTP request.

Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling)
A flaw was discovered in all versions of Undertow before Undertow Final, where HTTP request smuggling related to CVE-2017-2666 is possible against `HTTP/1.x` and `HTTP/2` due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from request other than their own.

Improper Restriction of Operations within the Bounds of a Memory Buffer
A flaw was discovered in Undertow where certain requests to the `Expect: ` header may cause an out of memory error. This flaw may potentially lead to a denial of service.

False Positive
This advisory has been marked as a false positive.

Improper Input Validation
A flaw was found in undertow, where the Servlet container causes `servletPath` to normalize incorrectly by truncating the path after semicolon which may lead to an application mapping resulting in the security bypass.