io.undertow:undertow-core (Maven)
Advisories
73
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 2.4.0.Beta1 or later clears every advisory below that has a fix.
Upgrade commands
maven
<dependency><groupId>io.undertow</groupId><artifactId>undertow-core</artifactId><version>2.4.0.Beta1</version></dependency>gradle
implementation("io.undertow:undertow-core:2.4.0.Beta1")Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-3x3v-w654-m28m Undertow: Denial of Service via Multipart/Form-Data Parsing on HTTP GET Requests |
Medium | all versions | No fix yet |
| GHSA-33hj-rcmx-86mv Undertow Servlets Vulnerable to Remote DoS via OutOfMemoryError when Passed Large Parameter Names |
High EPSS 0.40% |
>= 2.3.0.Alpha1, < 2.3.21.Final | 2.3.21.Final |
| GHSA-33hj-rcmx-86mv Undertow Servlets Vulnerable to Remote DoS via OutOfMemoryError when Passed Large Parameter Names |
High EPSS 0.40% |
< 2.2.39.Final | 2.2.39.Final |
| GHSA-33hj-rcmx-86mv Undertow Servlets Vulnerable to Remote DoS via OutOfMemoryError when Passed Large Parameter Names |
High EPSS 0.40% |
>= 2.4.0.Alpha1, < 2.4.0.Beta1 | 2.4.0.Beta1 |
| GHSA-j382-5jj3-vw4j Undertow HTTP server core doesn't properly validate the Host header in incoming HTTP requests |
Critical EPSS 1.33% |
No fix yet | |
| GHSA-j382-5jj3-vw4j Undertow HTTP server core doesn't properly validate the Host header in incoming HTTP requests |
Critical EPSS 1.33% |
>= 2.3.0.Alpha1, < 2.3.21.Final | 2.3.21.Final |
| GHSA-j382-5jj3-vw4j Undertow HTTP server core doesn't properly validate the Host header in incoming HTTP requests |
Critical EPSS 1.33% |
< 2.2.39.Final | 2.2.39.Final |
| GHSA-6h4f-pj3g-q8fq Undertow OutOfMemory when parsing form data encoding with application/x-www-form-urlencoded |
High EPSS 1.36% |
< 2.2.39.Final | 2.2.39.Final |
| GHSA-6h4f-pj3g-q8fq Undertow OutOfMemory when parsing form data encoding with application/x-www-form-urlencoded |
High EPSS 1.36% |
>= 2.4.0.Alpha1, < 2.4.0.Beta1 | 2.4.0.Beta1 |
| GHSA-6h4f-pj3g-q8fq Undertow OutOfMemory when parsing form data encoding with application/x-www-form-urlencoded |
High EPSS 1.36% |
>= 2.3.0.Alpha1, < 2.3.21.Final | 2.3.21.Final |
| GHSA-95h4-w6j8-2rp8 Undertow MadeYouReset HTTP/2 DDoS Vulnerability |
High EPSS 2.33% |
< 2.2.38.Final | 2.2.38.Final |
| GHSA-95h4-w6j8-2rp8 Undertow MadeYouReset HTTP/2 DDoS Vulnerability |
High EPSS 2.33% |
>= 2.3.0.Alpha1, < 2.3.20.Final | 2.3.20.Final |
| GHSA-22c5-cpvr-cfvq Withdrawn Advisory: undertow: information leakage via HTTP/2 request header reuse Withdrawn |
High | <= 2.3.18.Final | No fix yet |
| GHSA-3jrv-jgp8-45v3 Undertow incorrectly parses cookies |
High EPSS 1.09% |
>= 2.3.0.Alpha1, < 2.3.11.Final | 2.3.11.Final |
| GHSA-3jrv-jgp8-45v3 Undertow incorrectly parses cookies |
High EPSS 1.09% |
< 2.2.30.Final | 2.2.30.Final |
| GHSA-97cq-f4jm-mv8h Undertow Denial of Service vulnerability |
High EPSS 1.28% |
< 2.2.32.Final | 2.2.32.Final |
| GHSA-97cq-f4jm-mv8h Undertow Denial of Service vulnerability |
High EPSS 1.28% |
>= 2.3.0.Alpha1, < 2.3.13.Final | 2.3.13.Final |
| GHSA-9623-mqmm-5rcf Undertow vulnerable to Race Condition |
High EPSS 2.64% |
< 2.2.36.Final | 2.2.36.Final |
| GHSA-9623-mqmm-5rcf Undertow vulnerable to Race Condition |
High EPSS 2.64% |
>= 2.3.0.Alpha1, < 2.3.17.Final | 2.3.17.Final |
| GHSA-ch7q-gpff-h9hp Undertow Missing Release of Memory after Effective Lifetime vulnerability |
Medium EPSS 1.87% |
>= 2.3.0.Alpha1, < 2.3.15.Final | 2.3.15.Final |
| GHSA-ch7q-gpff-h9hp Undertow Missing Release of Memory after Effective Lifetime vulnerability |
Medium EPSS 1.87% |
< 2.2.34.Final | 2.2.34.Final |
| GHSA-xpp6-8r3j-ww43 Undertow Denial of Service vulnerability |
High EPSS 2.92% |
< 2.2.34.Final | 2.2.34.Final |
| GHSA-xpp6-8r3j-ww43 Undertow Denial of Service vulnerability |
High EPSS 2.92% |
>= 2.3.0.Alpha1, < 2.3.15.Final | 2.3.15.Final |
| GHSA-9442-gm4v-r222 Undertow's url-encoded request path information can be broken on ajp-listener |
High EPSS 1.70% |
>= 2.3.0.Alpha1, < 2.3.14.Final | 2.3.14.Final |
| GHSA-9442-gm4v-r222 Undertow's url-encoded request path information can be broken on ajp-listener |
High EPSS 1.70% |
< 2.2.33.Final | 2.2.33.Final |
| GHSA-w6qf-42m7-vh68 Undertow Uncontrolled Resource Consumption Vulnerability |
High EPSS 4.57% |
>= 2.3.0.Final, < 2.3.12.Final | 2.3.12.Final |
| GHSA-w6qf-42m7-vh68 Undertow Uncontrolled Resource Consumption Vulnerability |
High EPSS 4.57% |
< 2.2.31.Final | 2.2.31.Final |
| GHSA-v76w-3ph8-vm66 Undertow Path Traversal vulnerability |
Medium EPSS 1.71% |
>= 2.3.0.Alpha1, < 2.3.12.Final | 2.3.12.Final |
| GHSA-v76w-3ph8-vm66 Undertow Path Traversal vulnerability |
Medium EPSS 1.71% |
< 2.2.31.Final | 2.2.31.Final |
| GHSA-m4mm-pg93-fv78 Undertow denial of service vulnerability |
High EPSS 1.77% |
< 2.2.24.Final | 2.2.24.Final |
| GHSA-m4mm-pg93-fv78 Undertow denial of service vulnerability |
High EPSS 1.77% |
>= 2.3.0, < 2.3.5.Final | 2.3.5.Final |
| GHSA-pfcc-3g6r-8rg8 Undertow client not checking server identity presented by server certificate in https connections |
High EPSS 0.60% |
>= 2.3.0, < 2.3.5.Final | 2.3.5.Final |
| GHSA-pfcc-3g6r-8rg8 Undertow client not checking server identity presented by server certificate in https connections |
High EPSS 0.60% |
< 2.2.24.Final | 2.2.24.Final |
| GHSA-95rf-557x-44g5 Undertow vulnerable to Dos via Large AJP request |
High EPSS 1.09% |
< 2.2.19.Final | 2.2.19.Final |
| GHSA-95rf-557x-44g5 Undertow vulnerable to Dos via Large AJP request |
High EPSS 1.09% |
>= 2.3.0.Alpha1, < 2.3.0.Alpha2 | 2.3.0.Alpha2 |
| GHSA-339q-62wm-c39w Undertow vulnerable to Denial of Service (DoS) attacks |
High EPSS 1.74% |
< 2.2.15 | 2.2.15 |
| GHSA-fj7c-vg2v-ccrm Undertow vulnerable to memory exhaustion due to buffer leak |
High EPSS 1.77% |
< 2.0.40 | 2.0.40 |
| GHSA-fj7c-vg2v-ccrm Undertow vulnerable to memory exhaustion due to buffer leak |
High EPSS 1.77% |
>= 2.2.0, < 2.2.10 | 2.2.10 |
| GHSA-rf6q-vx79-mjxr Undertow Uncontrolled Resource Consumption |
High EPSS 1.32% |
< 2.0.40.Final | 2.0.40.Final |
| GHSA-rf6q-vx79-mjxr Undertow Uncontrolled Resource Consumption |
High EPSS 1.32% |
>= 2.1.0, < 2.2.11.Final | 2.2.11.Final |
| GHSA-mfhv-gwf8-4m88 undertow Race Condition vulnerability |
Medium EPSS 1.16% |
>= 2.1.0, < 2.2.9.Final | 2.2.9.Final |
| GHSA-mfhv-gwf8-4m88 undertow Race Condition vulnerability |
Medium EPSS 1.16% |
< 2.0.39.Final | 2.0.39.Final |
| GHSA-gv2w-88hx-8m9r Improper Authorization in Undertoe |
High EPSS 4.96% |
< 2.0.30 | 2.0.30 |
| GHSA-2w73-fqqj-c92p Improper Input Validation in Undertow |
High EPSS 1.62% |
< 2.1.0 | 2.1.0 |
| GHSA-vjxc-frw4-jmh5 Undertow vulnerable to Uncontrolled Resource Consumption |
High EPSS 2.18% |
< 2.0.29.Final | 2.0.29.Final |
| GHSA-h6p6-fc4w-cqhx Improper Limitation of a Pathname to a Restricted Directory in JBoss Undertow |
Medium EPSS 25.08% |
>= 1.2.0.Beta1, < 1.2.0.Beta3 | 1.2.0.Beta3 |
| GHSA-h6p6-fc4w-cqhx Improper Limitation of a Pathname to a Restricted Directory in JBoss Undertow |
Medium EPSS 25.08% |
>= 1.1.0.Beta1, < 1.1.0.CR5 | 1.1.0.CR5 |
| GHSA-h6p6-fc4w-cqhx Improper Limitation of a Pathname to a Restricted Directory in JBoss Undertow |
Medium EPSS 25.08% |
>= 1.0.0, < 1.0.17 | 1.0.17 |
| GHSA-3f57-w2rp-72fc Undertow Uncaught Exception vulnerability |
Medium EPSS 2.48% |
>= 1.4.0, < 1.4.3.Final | 1.4.3.Final |
| GHSA-3f57-w2rp-72fc Undertow Uncaught Exception vulnerability |
Medium EPSS 2.48% |
< 1.3.25.Final | 1.3.25.Final |
| GHSA-5gg7-5wv8-4gcj Undertow Request Smuggling vulnerability |
High EPSS 1.86% |
< 1.3.31 | 1.3.31 |
| GHSA-5gg7-5wv8-4gcj Undertow Request Smuggling vulnerability |
High EPSS 1.86% |
>= 2.0.0.Alpha1, < 2.0.0.Beta1 | 2.0.0.Beta1 |
| GHSA-5gg7-5wv8-4gcj Undertow Request Smuggling vulnerability |
High EPSS 1.86% |
>= 1.4.0, < 1.4.17 | 1.4.17 |
| GHSA-cp7v-vmv7-6x2q Incorrect Authorization in Undertow |
Medium EPSS 2.01% |
>= 2.0.0.Alpha1, < 2.0.2.FInal | 2.0.2.FInal |
| GHSA-cp7v-vmv7-6x2q Incorrect Authorization in Undertow |
Medium EPSS 2.01% |
< 1.4.24.Final | 1.4.24.Final |
| GHSA-rj76-h87p-r3wf Undertow vulnerable to Request Smuggling |
Medium EPSS 1.91% |
>= 1.3.0, < 1.3.31.Final | 1.3.31.Final |
| GHSA-rj76-h87p-r3wf Undertow vulnerable to Request Smuggling |
Medium EPSS 1.91% |
>= 2.0.0.Alpha1, < 2.0.0.Alpha2 | 2.0.0.Alpha2 |
| GHSA-rj76-h87p-r3wf Undertow vulnerable to Request Smuggling |
Medium EPSS 1.91% |
>= 1.4.0, < 1.4.17.Final | 1.4.17.Final |
| GHSA-gjjx-gqm4-wcgm Uncontrolled Resource Consumption in Undertow |
Medium EPSS 2.33% |
< 1.4.25.Final | 1.4.25.Final |
| GHSA-gjjx-gqm4-wcgm Uncontrolled Resource Consumption in Undertow |
Medium EPSS 2.33% |
>= 2.0.0.Alpha1, < 2.0.5.Final | 2.0.5.Final |
| GHSA-vf6r-mmhc-3xcm Exposure of Sensitive Information to an Unauthorized Actor in Undertow |
Medium EPSS 2.11% |
< 2.0.19.FINAL | 2.0.19.FINAL |
| GHSA-rhcw-wjcm-9h6g Denial of service in Undertow |
High EPSS 1.38% |
< 2.0.33 | 2.0.33 |
| GHSA-rhcw-wjcm-9h6g Denial of service in Undertow |
High EPSS 1.38% |
>= 2.1.0, < 2.1.5 | 2.1.5 |
| GHSA-qjwc-v72v-fq6r HTTP request smuggling in Undertow |
Medium EPSS 1.20% |
>= 2.1.0, < 2.1.6 | 2.1.6 |
| GHSA-qjwc-v72v-fq6r HTTP request smuggling in Undertow |
Medium EPSS 1.20% |
< 2.0.34 | 2.0.34 |
| GHSA-p9w3-gwc2-cr49 HTTP Request Smuggling in Undertow |
Medium EPSS 1.23% |
< 2.2.0.Final | 2.2.0.Final |
| GHSA-g4cp-h53p-v3v8 Allocation of Resources Without Limits or Throttling in Undertow |
High EPSS 1.22% |
< 2.1.1.Final | 2.1.1.Final |
| GHSA-cccf-7xw3-p2vr HTTP Request Smuggling in Undertow |
Medium EPSS 1.00% |
< 2.1.1.Final | 2.1.1.Final |
| GHSA-8vh8-vc28-m2hf Potential to access user credentials from the log files when debug logging enabled |
Critical EPSS 1.89% |
< 2.0.20 | 2.0.20 |
| GHSA-jwgx-9mmh-684w Credential exposure through log files in Undertow |
Critical EPSS 3.03% |
< 2.0.21 | 2.0.21 |
| GHSA-mcfm-h73v-635m Undertow-core vulnerable to HTTP Request Smuggling |
Medium EPSS 3.09% |
< 1.3.31 | 1.3.31 |
| GHSA-mcfm-h73v-635m Undertow-core vulnerable to HTTP Request Smuggling |
Medium EPSS 3.09% |
>= 1.4.0, < 1.4.17 | 1.4.17 |
| GHSA-3x7h-5hfr-hvjm Moderate severity vulnerability that affects io.undertow:undertow-core |
High EPSS 3.62% |
< 1.3.28 | 1.3.28 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor