Skip to content
OpenAdvisories
High DSA-3906-1 2 CVEs

undertow - security update

Published Jul 11, 2017 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 9 undertow 1.4.8-1+deb9u1

Vulnerabilities 2

  • High 7.5
    CVE-2017-2670

    Moderate severity vulnerability that affects io.undertow:undertow-core

    It was found in Undertow before 1.3.28 that with non-clean TCP close, the Websocket server gets into infinite loop on every IO thread, effectively causing DoS.

    [UNKNOWN] undertow undertow undertow Debian Ubuntu Maven
  • Medium 6.5
    CVE-2017-2666 Public exploit

    Undertow-core vulnerable to HTTP Request Smuggling

    It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data int…

    [UNKNOWN] undertow undertow undertow Debian Ubuntu Maven