Redhat Undertow vulnerabilities

• redhat undertow, red hat build of apache camel - hawtio 4, build of apache camel for spring boot 4 +21 more +23 more Undertow: undertow: request smuggling via malformed http request headers CVE-2026-28369 Fix available 8.7 HighMarch 27, 2026
• redhat undertow, red hat build of apache camel - hawtio 4, build of apache camel for spring boot 4 +20 more +22 more Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator CVE-2026-28367 Fix available 8.7 HighMarch 27, 2026
• redhat undertow, red hat build of apache camel - hawtio 4, build of apache camel for spring boot 4 +21 more +23 more Undertow: undertow: request smuggling via inconsistent header parsing CVE-2026-28368 Fix available 8.7 HighMarch 27, 2026
• redhat undertow, red hat build of apache camel - hawtio 4, build of apache camel 4.14.4 for spring boot 3.5.11 +33 more +35 more Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf CVE-2025-12543 Fix available 9.6 CriticalJanuary 7, 2026
• redhat undertow, red hat build of apache camel - hawtio 4, build of apache camel 4.14.2 for spring boot 3.5.8 +32 more +34 more Undertow: undertow madeyoureset http/2 ddos vulnerability CVE-2025-9784 Public exploitFix available 7.5 HighSeptember 2, 2025
• redhat undertow, red hat build of quarkus, data grid 8 +12 more +14 more Undertow: directory traversal vulnerability CVE-2024-1459 Fix available 5.3 MediumFebruary 12, 2024
• redhat undertow, red hat build of quarkus, data grid 8 +12 more +14 more Undertow: ajp request closes connection exceeding maxrequestsize CVE-2023-5379 Fix available 7.5 HighDecember 12, 2023
• redhat undertow, red hat build of quarkus, data grid 8 +25 more +27 more Undertow: outofmemoryerror due to @multipartconfig handling CVE-2023-3223 Fix available 7.5 HighSeptember 27, 2023
• redhat undertow, netapp oncommand workflow automation, red hat eap 7.4.10 release +31 more +33 more Undertow: infinite loop in sslconduit during close CVE-2023-1108 Fix available 7.5 HighApril 7, 2023
• red hat undertow, redhat build of quarkus, integration camel for spring boot +7 more +9 more Undertow client not checking server identity presented by server certificate in https connections CVE-2022-4492 Fix available 7.5 HighFebruary 23, 2023
• red hat undertow, netapp active iq unified manager, cloud secure agent +6 more +8 more A flaw was found in Undertow. Denial of service can be achieved as Undertow server waits for the... CVE-2022-2764 Fix available 4.9 MediumSeptember 1, 2022
• red hat undertow, netapp active iq unified manager, cloud secure agent +4 more +6 more A flaw was found in Undertow. For an AJP 400 response, EAP 7 is improperly sending two response... CVE-2022-1319 Fix available 7.5 HighAugust 31, 2022
• red hat undertow, netapp active iq unified manager, cloud secure agent +7 more +9 more A flaw was found in Undertow. A potential security issue in flow control handling by the browser... CVE-2022-1259 7.5 HighAugust 31, 2022
• red hat undertow, redhat integration camel k, jboss fuse +2 more Undertow vulnerable to Dos via Large AJP request CVE-2022-2053 Fix available 7.5 HighAugust 5, 2022
• red hat undertow, netapp cloud secure agent, oncommand insight +3 more +5 more Undertow vulnerable to Denial of Service (DoS) attacks CVE-2021-3859 Fix available 7.5 HighJuly 15, 2022
• red hat undertow, redhat fuse, integration camel k +4 more +6 more Undertow vulnerable to memory exhaustion due to buffer leak CVE-2021-3690 Fix available 7.5 HighJuly 15, 2022
• red hat undertow, netapp active iq unified manager, oncommand insight +5 more +7 more undertow Race Condition vulnerability CVE-2021-3597 Fix available 5.9 MediumMay 24, 2022
• red hat undertow, netapp active iq unified manager, oncommand insight +5 more +7 more Undertow Uncontrolled Resource Consumption CVE-2021-3629 Fix available 5.9 MediumMay 24, 2022
• red hat undertow, redhat jboss-remoting, netapp active iq unified manager +1 more +3 more A flaw was found in Undertow when using Remoting as shipped in Red Hat Jboss EAP before version 7... CVE-2019-19343 Fix available 7.5 HighMarch 23, 2021
• red hat undertow, redhat jboss fuse, openshift application runtimes +2 more Denial of service in Undertow CVE-2020-27782 Fix available 7.5 HighFebruary 23, 2021
• red hat undertow, netapp active iq unified manager, oncommand workflow automation +2 more HTTP request smuggling in Undertow CVE-2021-20220 Fix available 4.8 MediumFebruary 23, 2021
• red hat undertow, redhat jboss enterprise application platform, single sign-on +2 more HTTP Request Smuggling in Undertow CVE-2020-10687 Fix available 4.8 MediumSeptember 23, 2020
• red hat undertow, netapp oncommand insight, redhat jboss enterprise application platform +1 more +3 more Allocation of Resources Without Limits or Throttling in Undertow CVE-2020-10705 Fix available 7.5 HighJune 10, 2020
• red hat undertow, netapp active iq unified manager, oncommand insight +5 more +7 more HTTP Request Smuggling in Undertow CVE-2020-10719 Fix available 6.5 MediumMay 26, 2020
• red hat undertow Improper Authorization in Undertoe CVE-2020-1745 Fix available 8.6 HighApril 28, 2020
• red hat undertow, redhat jboss data grid, jboss enterprise application platform +3 more +5 more Improper Input Validation in Undertow CVE-2020-1757 Fix available 8.1 HighApril 21, 2020
• red hat undertow, netapp active iq unified manager, redhat jboss data grid +3 more +5 more Undertow vulnerable to Uncontrolled Resource Consumption CVE-2019-14888 Fix available 7.5 HighJanuary 23, 2020
• red hat undertow, netapp active iq unified manager, redhat jboss data grid +4 more +6 more Potential to access user credentials from the log files when debug logging enabled CVE-2019-10212 Fix available 4.8 MediumOctober 2, 2019
• red hat undertow, netapp active iq unified manager, redhat jboss data grid +3 more +5 more Undertow Missing Authorization when requesting a protected directory without trailing slash CVE-2019-10184 Fix available 5.3 MediumJuly 25, 2019
• red hat undertow, netapp active iq unified manager, redhat jboss data grid +3 more +5 more Credential exposure through log files in Undertow CVE-2019-3888 Fix available 5.3 MediumJune 12, 2019
• red hat undertow, redhat jboss enterprise application platform +1 more Exposure of Sensitive Information to an Unauthorized Actor in Undertow CVE-2018-14642 Fix available 5.3 MediumSeptember 18, 2018
• red hat undertow, redhat virtualization, virtualization host +2 more Uncontrolled Resource Consumption in Undertow CVE-2018-1114 Fix available 6.5 MediumSeptember 11, 2018
• red hat undertow, redhat jboss enterprise application platform +1 more Undertow Request Smuggling vulnerability CVE-2017-12165 Fix available 2.6 LowJuly 27, 2018
• [unknown] undertow, redhat jboss enterprise application platform, virtualization host +2 more Improper Neutralization of CRLF Sequences in HTTP Headers in Undertow CVE-2018-1067 Fix available 5.4 MediumMay 21, 2018
• red hat undertow, redhat jboss enterprise application platform, jboss fuse +1 more +3 more Incorrect Authorization in Undertow CVE-2017-12196 Fix available 4.8 MediumApril 18, 2018
• red hat undertow Undertow vulnerable to Request Smuggling CVE-2017-7559 Fix available 6.1 MediumJanuary 10, 2018
• [unknown] undertow, debian linux, redhat jboss enterprise application platform +2 more Moderate severity vulnerability that affects io.undertow:undertow-core CVE-2017-2670 Fix available 7.5 HighJuly 11, 2017
• [unknown] undertow, debian linux, redhat jboss enterprise application platform +2 more Undertow-core vulnerable to HTTP Request Smuggling CVE-2017-2666 Public exploitFix available 6.5 MediumJuly 11, 2017
• redhat undertow Improper Limitation of a Pathname to a Restricted Directory in JBoss Undertow CVE-2014-7816 Public exploitFix available EPSS 25.1% 5.0 MediumDecember 1, 2014