CVE-2022-4492

Undertow client not checking server identity presented by server certificate in https connections

7.5 HighFix available

The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and in http/2. I would add it to any TLS client protocol.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: None

Exploit likelihood

0.60%Down 0.3 points since Feb 24, 2023

What each source reports

NVD Score used 7.5

Record: CVE-2022-4492
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-918
Updated: 2026-11-02

CVE List No score

Record: CVE-2022-4492
Weakness: CWE-918
Updated: 2026-11-02

EUVDEUVD-2023-0759 0.0

Record: EUVD-2023-0759
CVSS: 0.0 NoneCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-pfcc-3g6r-8rg8 9.8

Undertow client not checking server identity presented by server certificate in https connections

The undertow client is not checking the server identity presented by the server certificate in https connections. This should be performed by default in https and in http/2.

Record: GHSA-pfcc-3g6r-8rg8
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-918
Updated: 2026-11-02

OSV 7.5

Record: CVE-2022-4492
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVGHSA-pfcc-3g6r-8rg8 9.8

Undertow client not checking server identity presented by server certificate in https connections

The undertow client is not checking the server identity presented by the server certificate in https connections. This should be performed by default in https and in http/2.

Record: GHSA-pfcc-3g6r-8rg8
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-918
Updated: 2026-11-02

Show 11 moreShow less

OSVRHSA-2023:1512 9.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 7 security update

Record: RHSA-2023:1512
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2023:1513 9.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 8 security update

Record: RHSA-2023:1513
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2023:1514 9.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 9 security update

Record: RHSA-2023:1514
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2023:2705 7.5

Red Hat Security Advisory: Red Hat Single Sign-On 7.6.3 security update on RHEL 7

Record: RHSA-2023:2705
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2023:2706 7.5

Red Hat Security Advisory: Red Hat Single Sign-On 7.6.3 security update on RHEL 8

Record: RHSA-2023:2706
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2023:2707 7.5

Red Hat Security Advisory: Red Hat Single Sign-On 7.6.3 security update on RHEL 9

Record: RHSA-2023:2707
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2025:9582 7.5

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.11 on RHEL 7 security update

Record: RHSA-2025:9582
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2025:9583 7.5

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.14 Security update

Record: RHSA-2025:9583
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2022-4492 7.5

Record: UBUNTU-CVE-2022-4492
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

OSVCLSA-2026-1782349133 No score

TuxCare security update for io.undertow:undertow-core (5 CVEs)

TuxCare rebuilt io.undertow:undertow-core to address 5 CVEs. Fixed in 2.3.0.Final-tuxcare.3.

Record: CLSA-2026-1782349133
Updated: 2026-11-02

OSVDEBIAN-CVE-2022-4492 No score

Record: DEBIAN-CVE-2022-4492
Updated: 2026-11-03

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`io.undertow:undertow-core` Maven	2.3.0 up to 2.3.5.Final	2.3.5.Final
`io.undertow:undertow-core` Maven	before 2.2.24.Final	2.2.24.Final
`io.undertow:undertow-core` TuxCare:Maven From an advisory covering 5 CVEs	2.3.0.Final up to 2.3.0.Final-tuxcare.3, plus listed versions 2.3.0.Final-tuxcare.12.3.0.Final-tuxcare.2	2.3.0.Final-tuxcare.3
`undertow` Debian:14	before 2.3.8-2, plus listed versions 1.3.11-11.3.16-11.3.19-11.3.21-11.3.23-1 Show 45 moreShow less 1.3.4-11.3.5-11.3.7-11.4.0-11.4.1-11.4.18-11.4.20-11.4.21-11.4.21-21.4.22-11.4.23-11.4.23-21.4.23-31.4.25-11.4.25-21.4.3-11.4.4-11.4.6-11.4.7-11.4.8-12.0.23-12.0.25-12.0.26-12.0.27-12.0.28-12.0.29-12.0.30-12.1.0-12.1.1-12.1.3-12.2.0-12.2.10-12.2.12-12.2.13-12.2.14-12.2.16-12.2.17-12.2.18-12.2.19-12.2.2-12.2.20-12.2.21-12.2.3-12.2.4-12.2.5-1	2.3.8-2
`io.undertow:undertow-core` Maven	2.3.0 up to 2.3.5.Final, plus listed versions 2.3.0.Final2.3.1.Final2.3.2.Final2.3.3.Final2.3.4.Final	2.3.5.Final
`io.undertow:undertow-core` Maven	before 2.2.24.Final, plus listed versions 1.0.0.Alpha11.0.0.Alpha101.0.0.Alpha111.0.0.Alpha121.0.0.Alpha13 Show 45 moreShow less 1.0.0.Alpha141.0.0.Alpha151.0.0.Alpha161.0.0.Alpha171.0.0.Alpha181.0.0.Alpha191.0.0.Alpha21.0.0.Alpha201.0.0.Alpha211.0.0.Alpha221.0.0.Alpha31.0.0.Alpha41.0.0.Alpha51.0.0.Alpha61.0.0.Alpha71.0.0.Alpha81.0.0.Alpha91.0.0.Beta11.0.0.Beta101.0.0.Beta111.0.0.Beta121.0.0.Beta131.0.0.Beta141.0.0.Beta151.0.0.Beta161.0.0.Beta171.0.0.Beta181.0.0.Beta191.0.0.Beta21.0.0.Beta201.0.0.Beta211.0.0.Beta221.0.0.Beta231.0.0.Beta241.0.0.Beta251.0.0.Beta261.0.0.Beta271.0.0.Beta281.0.0.Beta291.0.0.Beta31.0.0.Beta301.0.0.Beta311.0.0.Beta321.0.0.Beta331.0.0.Beta4	2.2.24.Final
`eap7-snakeyaml` Red Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 9 CVEs	before 0:1.33.0-2.SP1_redhat_00001.1.el7eap	0:1.33.0-2.SP1_redhat_00001.1.el7eap
`eap7-undertow` Red Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 9 CVEs	before 0:2.2.23-1.SP2_redhat_00001.1.el7eap	0:2.2.23-1.SP2_redhat_00001.1.el7eap
`eap7-undertow-jastow` Red Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 9 CVEs	before 0:2.0.14-1.Final_redhat_00001.1.el7eap	0:2.0.14-1.Final_redhat_00001.1.el7eap
`eap7-activemq-artemis-native` Red Hat:jboss_enterprise_application_platform:7.4::el7 From an advisory covering 9 CVEs	before 1:1.0.2-3.redhat_00004.1.el7eap	1:1.0.2-3.redhat_00004.1.el7eap

Show 290 moreShow less

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-4492 is a high vulnerability (CVSS 7.5) in Red Hat Undertow, published February 23, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.60%, the 48th percentile. Fixed in io.undertow:undertow-core 2.3.5.Final.

References

Show 180 moreShow less

This page doesn't list everything

Left out here: 112 package rows and 244 versions. The JSON record has them.