Skip to content
OpenAdvisories

Package · Debian

undertow

58 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.6
    CVE-2025-12543

    Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf

    A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malici…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu Wolfi Maven
  • Critical 9.8
    CVE-2022-4492

    Undertow client not checking server identity presented by server certificate in https connections

    The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and in http/2. I would add it to any TLS client protocol.

    undertow undertow io.undertow:undertow-core Debian Ubuntu Maven