Search for packages
| purl | pkg:maven/io.undertow/undertow-core@2.3.0 |
| Tags | Ghost |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk | 4.5 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-732h-twxw-aaap
Aliases: CVE-2022-2053 GHSA-95rf-557x-44g5 |
CVE-2022-2053 undertow: Large AJP request may cause DoS |
Affected by 11 other vulnerabilities. |
|
VCID-f6a4-nmup-aaaq
Aliases: CVE-2023-1108 GHSA-m4mm-pg93-fv78 |
A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates. |
Affected by 9 other vulnerabilities. |
|
VCID-sssr-kebe-aaah
Aliases: CVE-2022-2764 |
CVE-2022-2764 Undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations |
Affected by 11 other vulnerabilities. |
|
VCID-tw4d-xnwu-aaah
Aliases: CVE-2022-1319 |
A flaw was found in Undertow. For an AJP 400 response, EAP 7 is improperly sending two response packets, and those packets have the reuse flag set even though JBoss EAP closes the connection. A failure occurs when the connection is reused after a 400 by CPING since it reads in the second SEND_HEADERS response packet instead of a CPONG. |
Affected by 11 other vulnerabilities. |
|
VCID-uyp8-req2-aaag
Aliases: CVE-2022-4492 GHSA-pfcc-3g6r-8rg8 |
Undertow client not checking server identity presented by server certificate in https connections |
Affected by 9 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||