{"id":"CVE-2022-1259","aliases":["EUVD-2022-24592","GHSA-5837-3xvj-5g8r","RHSA-2022:6821","RHSA-2022:6822","RHSA-2022:6823","RHSA-2025:9582","RHSA-2025:9583","UBUNTU-CVE-2022-1259"],"status":"published","title":"A flaw was found in Undertow. A potential security issue in flow control handling by the browser...","description":"A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server. This flaw exists because of an incomplete fix for CVE-2021-3629.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01392,"percentile":0.72584,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-400"],"published":"2022-08-31T00:00:00Z","modified":"2026-10-28T02:30:35Z","affected":[{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-undertow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.19-1.SP2_redhat_00001.1.el7eap"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el7","package":"eap7-snakeyaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.31.0-1.redhat_00001.1.el7eap"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-undertow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.19-1.SP2_redhat_00001.1.el8eap"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el8","package":"eap7-snakeyaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.31.0-1.redhat_00001.1.el8eap"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-undertow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.19-1.SP2_redhat_00001.1.el9eap"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:7.4::el9","package":"eap7-snakeyaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.31.0-1.redhat_00001.1.el9eap"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-glassfish-el","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-4.b08_redhat_00005.1.ep7.el7"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-glassfish-el-impl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-4.b08_redhat_00005.1.ep7.el7"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-hibernate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.17-3.Final_redhat_00004.1.ep7.el7"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-hibernate-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.17-3.Final_redhat_00004.1.ep7.el7"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-hibernate-entitymanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.17-3.Final_redhat_00004.1.ep7.el7"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-hibernate-envers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.17-3.Final_redhat_00004.1.ep7.el7"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-hibernate-infinispan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.17-3.Final_redhat_00004.1.ep7.el7"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-hibernate-java8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.1.17-3.Final_redhat_00004.1.ep7.el7"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.11.6-3.SP1_redhat_00003.1.ep7.el7"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-jboss-ejb-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.12-1.Final_redhat_00002.1.ep7.el7"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.63-2.Final_redhat_00003.1.ep7.el7"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-netty-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.63-2.Final_redhat_00003.1.ep7.el7"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-undertow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.18-16.SP14_redhat_00001.1.ep7.el7"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-wildfly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.1.11-4.GA_redhat_00002.1.ep7.el7"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-wildfly-elytron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.14-1.Final_redhat_00001.1.ep7.el7"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-wildfly-http-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.21-1.Final_redhat_00001.1.ep7.el7"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-wildfly-http-client-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.21-1.Final_redhat_00001.1.ep7.el7"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-wildfly-http-ejb-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.21-1.Final_redhat_00001.1.ep7.el7"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-wildfly-http-naming-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.21-1.Final_redhat_00001.1.ep7.el7"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-wildfly-http-transaction-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.21-1.Final_redhat_00001.1.ep7.el7"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-wildfly-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.1.11-4.GA_redhat_00002.1.ep7.el7"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-wildfly-naming-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.13-1.Final_redhat_00001.1.ep7.el7"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-wildfly-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.12-1.Final_redhat_00001.1.ep7.el7"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-wildfly-openssl-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.12-1.Final_redhat_00001.1.ep7.el7"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-wildfly-openssl-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.12-6.Final_redhat_00001.1.ep7.el7"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.1::el7","package":"eap7-wildfly-openssl-linux-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.12-6.Final_redhat_00001.1.ep7.el7"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.4-3.redhat_00006.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.4-3.redhat_00006.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.4-5.redhat_00006.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jackson-datatype-jdk8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.4-2.redhat_00006.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jackson-datatype-jsr310","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.4-2.redhat_00006.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jackson-jaxrs-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.4-3.redhat_00006.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jackson-jaxrs-json-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.4-3.redhat_00006.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jackson-jaxrs-providers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.4-3.redhat_00006.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jackson-module-jaxb-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.4-5.redhat_00006.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jackson-modules-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.4-5.redhat_00006.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jackson-modules-java8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.10.4-2.redhat_00006.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-16.Final_redhat_00017.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-16.Final_redhat_00017.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-16.Final_redhat_00017.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-eap6.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-16.Final_redhat_00017.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-eap6.4-to-eap7.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-16.Final_redhat_00017.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-eap7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-16.Final_redhat_00017.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-eap7.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-16.Final_redhat_00017.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-eap7.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-16.Final_redhat_00017.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-eap7.2-to-eap7.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-16.Final_redhat_00017.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-eap7.3-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-16.Final_redhat_00017.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-wildfly10.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-16.Final_redhat_00017.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-wildfly10.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-16.Final_redhat_00017.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-wildfly11.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-16.Final_redhat_00017.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-wildfly12.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-16.Final_redhat_00017.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-wildfly13.0-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-16.Final_redhat_00017.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-wildfly14.0-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-16.Final_redhat_00017.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-wildfly15.0-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-16.Final_redhat_00017.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-wildfly16.0-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-16.Final_redhat_00017.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-wildfly17.0-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-16.Final_redhat_00017.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-wildfly18.0-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-16.Final_redhat_00017.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-wildfly8.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-16.Final_redhat_00017.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-jboss-server-migration-wildfly9.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-16.Final_redhat_00017.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.63-5.Final_redhat_00003.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-netty-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.63-5.Final_redhat_00003.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-undertow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.41-4.SP5_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-wildfly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.14-3.GA_redhat_00002.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-wildfly-elytron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.17-1.Final_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-wildfly-elytron-tool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.17-1.Final_redhat_00001.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-wildfly-java-jdk11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.14-3.GA_redhat_00002.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-wildfly-java-jdk8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.14-3.GA_redhat_00002.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-wildfly-javadocs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.14-3.GA_redhat_00002.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform_eus:7.3::el7","package":"eap7-wildfly-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.14-3.GA_redhat_00002.1.el7eap"}]}],"bundled":14},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"undertow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.4-1","1.3.5-1","1.3.7-1","1.3.11-1","1.3.16-1","1.3.16-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"undertow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.20-1","1.4.21-1","1.4.22-1","1.4.23-1","1.4.23-2build1","1.4.23-3","1.4.23-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"undertow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.23-1","2.0.27-1","2.0.28-1","2.0.29-1","2.0.29-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"undertow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.8-1","2.2.12-1","2.2.13-1","2.2.14-1","2.2.16-1","2.2.16-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"undertow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.8-2","2.3.8-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"undertow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.18-1","2.3.18-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"undertow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.20-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"undertow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.18-2","2.3.20-1","2.3.20-1ubuntu1"]}],"products":[{"vendor":"netapp","product":"active_iq_unified_manager"},{"vendor":"netapp","product":"cloud_secure_agent"},{"vendor":"netapp","product":"oncommand_insight"},{"vendor":"netapp","product":"oncommand_workflow_automation"},{"vendor":"red hat","product":"undertow"},{"vendor":"redhat","product":"build_of_quarkus"},{"vendor":"redhat","product":"integration_camel_k"},{"vendor":"redhat","product":"jboss_enterprise_application_platform"},{"vendor":"redhat","product":"openshift_application_runtimes"},{"vendor":"redhat","product":"single_sign-on"},{"vendor":"redhat","product":"undertow"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2072339","tags":["x_transferred","Issue Tracking","Vendor Advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-1259","tags":["x_transferred","Vendor Advisory","web","report"]},{"url":"https://security.netapp.com/advisory/ntap-20221014-0006/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1259","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5837-3xvj-5g8r"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1259.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:6821","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2095862","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2126789","tags":["report"]},{"url":"https://issues.redhat.com/browse/JBEAP-23618","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-23687","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-23738","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-23741","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-23753","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-23772","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-23794","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-23802","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-23803","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-23805","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-23816","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-23818","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-23869","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-23881","tags":["article"]},{"url":"https://issues.redhat.com/browse/JBEAP-23912","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6821.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-1259","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-2053","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-2053","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2053","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25857","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25857","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25857","tags":["advisory"]},{"url":"https://bitbucket.org/snakeyaml/snakeyaml/issues/525","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2022:6822","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/JBEAP-23619","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6822.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:6823","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/JBEAP-23620","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6823.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:9582","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.1","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.1/html-single/installation_guide/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1834512","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1881353","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1885485","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1901304","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1928172","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1965497","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2004133","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2004135","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2064698","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124682","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2153260","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2242099","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2262849","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2262918","tags":["report"]},{"url":"https://issues.redhat.com/browse/JBEAP-29413","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9582.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-10740","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-10740","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10740","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-13949","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-13949","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13949","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-25638","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-25638","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-25638","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-25644","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-25644","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-25644","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-27782","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-27782","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-27782","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-36518","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-36518","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-36518","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-57j2-w4cx-62h2","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-28170","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-28170","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28170","tags":["advisory"]},{"url":"https://securitylab.github.com/advisories/GHSL-2020-021-jakarta-el/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-37136","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-37136","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-37136","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-37137","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-37137","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-37137","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-3143","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-3143","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3143","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-4492","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-4492","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-4492","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-5379","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-5379","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5379","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-1233","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-1233","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-1233","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-v4mm-q8fv-r2w5","tags":["advisory"]},{"url":"https://github.com/wildfly/wildfly/pull/17812/commits/0c02350bc0d84287bed46e7c32f90b36e50d3523","tags":["article"]},{"url":"https://issues.redhat.com/browse/WFLY-19226","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2025:9583","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/7.3/html-single/installation_guide/index","tags":["article"]},{"url":"https://access.redhat.com/security/vulnerabilities/RHSB-2023-003","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2073890","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2174246","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2185662","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2209689","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2264928","tags":["report"]},{"url":"https://issues.redhat.com/browse/JBEAP-29448","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9583.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-1319","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-1319","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1319","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-1108","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-1108","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-1108","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-m4mm-pg93-fv78","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-1973","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-1973","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-1973","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-3223","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-3223","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-3223","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-1635","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-1635","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-1635","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-1259","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-1259","description":"A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server. This flaw exists because of an incomplete fix for CVE-2021-3629.","status":"published","published":"2022-08-31T00:00:00Z","modified":"2024-08-02T23:55:24.711Z","cwes":["CWE-400"],"updated_at":"2026-11-02T14:34:38.581997Z"}],"euvd":[{"id":"EUVD-2022-24592","description":"A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server. This flaw exists because of an incomplete fix for CVE-2021-3629.","status":"published","published":"2022-08-31T00:00:00Z","modified":"2024-08-02T23:55:24Z","updated_at":"2026-11-03T03:26:01.998866Z"}],"ghsa":[{"id":"GHSA-5837-3xvj-5g8r","title":"A flaw was found in Undertow. A potential security issue in flow control handling by the browser...","description":"A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server. This flaw exists because of an incomplete fix for CVE-2021-3629.","status":"published","published":"2022-09-01T00:00:22Z","modified":"2023-01-28T05:04:54Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:44:15.993879Z"}],"nvd":[{"id":"CVE-2022-1259","description":"A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server. This flaw exists because of an incomplete fix for CVE-2021-3629.","status":"published","published":"2022-08-31T16:15:09.23Z","modified":"2026-06-17T04:22:06.423Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:07:26.802986Z"}],"osv":[{"id":"RHSA-2022:6821","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.7 Security update","status":"published","published":"2024-09-30T07:05:54Z","modified":"2026-10-02T10:02:12Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2022:6822","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.7 Security update","status":"published","published":"2024-09-30T07:05:45Z","modified":"2026-10-02T10:02:12Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2022:6823","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.7 Security update","status":"published","published":"2024-09-30T07:06:11Z","modified":"2026-10-02T10:02:13Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"RHSA-2025:9582","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.11 on RHEL 7 security update","status":"published","published":"2025-06-25T10:06:35Z","modified":"2026-10-14T10:11:46Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RHSA-2025:9583","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.14 Security update","status":"published","published":"2025-06-25T10:06:36Z","modified":"2026-10-14T10:11:47Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"UBUNTU-CVE-2022-1259","description":"A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server. This flaw exists because of an incomplete fix for CVE-2021-3629.","status":"published","published":"2022-08-31T16:15:00Z","modified":"2026-10-17T12:55:56.209934424Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:51.630172Z"},{"id":"CVE-2022-1259","description":"A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server. This flaw exists because of an incomplete fix for CVE-2021-3629.","status":"published","published":"2022-08-31T00:00:00Z","modified":"2026-10-28T02:30:35.120670194Z","cwes":["CWE-400"],"updated_at":"2026-11-02T15:44:23.245966Z"}]}}