Skip to content
OpenAdvisories
Medium · 5.9 CVE-2016-7046 EUVD-2022-2166GHSA-3f57-w2rp-72fc

Undertow Uncaught Exception vulnerability

Published Oct 3, 2016 · Updated Aug 6, 2024 · Assigned by mitre

Description

Red Hat JBoss Enterprise Application Platform (EAP) 7, when operating as a reverse-proxy with default buffer sizes, allows remote attackers to cause a denial of service (CPU and disk consumption) via a long URL.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 undertow 1.4.3-1 —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 undertow No fix yet —
Ubuntu 26.04 LTS undertow No fix yet —
Ubuntu 25.10 undertow No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS undertow No fix yet —
Ubuntu Pro 16.04 LTS undertow No fix yet —
ReleasePackageFixed inAdvisory
Red Hat JBoss EAP 7 eap7-activemq-artemis +15 1.5.5.008-1.redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-antlr 2.7.7-35.redhat_7.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-apache-commons-beanutils 1.9.3-1.redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-apache-commons-cli 1.3.1-1.redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-apache-commons-io 2.5.0-2.redhat_2.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-apache-cxf +3 3.1.12-1.redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-apache-mime4j 0.6.0-2.redhat_6.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-artemis-native +1 1.5.0-5.redhat_1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-artemis-wildfly-integration 1.0.2-3.redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-azure-storage 5.0.0-1.redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-bouncycastle +3 1.56.0-4.redhat_2.2.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-codehaus-jackson +4 1.9.13-7.redhat_4.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-commons-logging-jboss-logmanager 1.0.2-2.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-cryptacular 1.2.0-3.redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-cxf-xjc-dv +5 3.0.5-3.redhat_2.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-ecj 4.6.1-1.redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-elytron-web +1 1.0.1-1.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-glassfish-concurrent 1.0.0-3.redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-glassfish-el +1 3.0.1-2.b08_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-glassfish-jaf 1.1.1-21.redhat_5.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-glassfish-javamail 1.5.6-4.redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-glassfish-jsf 2.2.13-5.SP4_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-glassfish-json 1.0.4-4.redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-guava +1 20.0.0-1.redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-h2database 1.4.193-4.redhat_2.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-hibernate +5 5.0.11-1.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454, RHSA-2016:2641
Red Hat JBoss EAP 7 eap7-hibernate-commons-annotations 5.0.1-3.Final_redhat_2.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-hibernate-jpa-2.1-api 1.0.0-3.Final_redhat_2.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-hibernate-search +5 5.5.8-1.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-hibernate-validator +1 5.3.5-3.Final_redhat_2.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-httpcomponents-asyncclient 4.1.2-1.redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-httpcomponents-client 4.5.2-1.redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-httpcomponents-core 4.4.4-2.redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-infinispan +5 8.2.8-1.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-ironjacamar +8 1.4.6-2.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jackson-core +9 2.8.9-1.redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jandex 2.0.3-1.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jansi 1.16.0-5.redhat_4.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-java-classmate 1.3.3-1.redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-javassist 3.20.0-2.GA_redhat_3.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jaxbintros 1.0.2-19.GA_redhat_8.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jaxen 1.1.6-3.redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jberet +1 1.2.4-3.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jboss-aesh 0.66.19-2.redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jboss-annotations-api_1.2_spec 1.0.0-2.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jboss-classfilewriter 1.2.1-2.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jboss-concurrency-api_1.0_spec 1.0.0-4.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jboss-connector-api_1.7_spec 1.0.0-5.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jboss-dmr 1.4.1-2.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jboss-ec2-eap +1 7.0.3-3.GA_redhat_2.ep7.el6 RHSA-2017:3458, RHSA-2016:2642
Red Hat JBoss EAP 7 eap7-jboss-ejb-api_3.2_spec +4 1.0.0-3.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jboss-ejb-client 4.0.9-1.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jboss-ejb3-ext-api 2.2.0-4.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jboss-el-api_3.0_spec 1.0.9-3.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jboss-genericjms 2.0.0-4.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jboss-iiop-client +1 1.0.1-2.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jboss-invocation 1.5.0-5.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jboss-jaxb-api_2.2_spec 1.0.4-6.Final_redhat_4.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jboss-jaxrpc-api_1.1_spec 1.0.1-8.Final_redhat_5.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jboss-jaxws-api_2.2_spec 2.0.4-2.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jboss-jms-api_2.0_spec 1.0.1-4.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jboss-jsf-api_2.2_spec 2.2.13-4.redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jboss-jsp-api_2.3_spec +2 1.0.1-3.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jboss-logmanager 2.0.7-3.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jboss-metadata +5 10.0.2-3.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jboss-modules 1.6.0-11.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jboss-openjdk-orb 8.0.8-2.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jboss-remoting 4.0.21-1.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454, RHSA-2016:2641
Red Hat JBoss EAP 7 eap7-jboss-remoting-jmx 3.0.0-8.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jboss-saaj-api_1.3_spec 1.0.4-2.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jboss-seam-int 7.0.0-5.GA_redhat_2.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jboss-security-xacml 2.0.8-16.Final_redhat_8.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jboss-server-migration +18 1.0.3-4.Final_redhat_4.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jboss-transaction-spi 7.6.0-1.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jboss-vfs 3.2.12-2.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jboss-websocket-api_1.1_spec 1.1.1-3.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jboss-weld-2.2-api 2.4.0-2.SP1_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jboss-xnio-base 3.4.0-1.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454, RHSA-2016:2641
Red Hat JBoss EAP 7 eap7-jbossws-common-tools 1.2.4-1.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jbossws-cxf 5.1.9-2.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jbossws-spi 3.1.4-3.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jettison 1.3.8-1.redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jgroups 3.6.13-2.Final_redhat_2.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jgroups-azure 1.1.0-1.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-joda-time 2.9.7-1.redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jsoup 1.8.3-3.redhat_2.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-jul-to-slf4j-stub 1.0.1-6.Final_redhat_3.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-mod_cluster 1.3.7-1.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-mustache-java +1 0.9.4-1.redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-narayana +10 5.5.30-2.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-neethi 3.0.3-3.redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-netty +1 4.1.9-1.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-netty-xnio-transport 0.1.2-1.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-objectweb-asm 3.3.1-14.redhat_13.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-picketbox +1 5.0.2-2.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-picketbox-commons 1.0.0-3.final_redhat_5.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-resteasy +16 3.0.24-1.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-shibboleth-java-support 7.1.1-3.redhat_2.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-slf4j +3 1.7.22-2.redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-snakeyaml 1.17.0-1.redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-staxmapper 1.3.0-1.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-sun-saaj-1.3-impl 1.3.16-16.SP1_redhat_6.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-sun-ws-metadata-2.0-api 1.0.0-6.MR1_redhat_8.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-taglibs-standard-impl +3 1.2.6-1.RC1_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-txw2 +7 2.2.11-10.redhat_4.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-undertow 1.3.25-1.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454, RHSA-2016:2641
Red Hat JBoss EAP 7 eap7-undertow-jastow +2 2.0.2-1.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-vdx +2 1.1.6-1.redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-weld-core +3 2.4.3-1.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-wildfly +1 7.0.3-4.GA_redhat_2.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454, RHSA-2016:2641
Red Hat JBoss EAP 7 eap7-wildfly-client-config 1.0.0-7.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-wildfly-common 1.2.0-10.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-wildfly-discovery +1 1.0.0-9.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-wildfly-elytron 1.1.7-1.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-wildfly-elytron-tool 1.0.5-1.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-wildfly-http-client +4 1.0.8-1.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-wildfly-javadocs 7.0.3-2.GA_redhat_3.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454, RHSA-2016:2641
Red Hat JBoss EAP 7 eap7-wildfly-naming-client 1.0.7-1.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-wildfly-openssl +2 1.0.2-1.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-wildfly-openssl-linux 1.0.2-13.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-wildfly-web-console-eap 2.9.15-2.Final_redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-woodstox-core 5.0.3-1.redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-wss4j +6 2.1.10-1.redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-xerces-j2 2.11.0-24.SP5_redhat_1.1.ep7.el6 RHSA-2016:2641, RHSA-2016:2640
Red Hat JBoss EAP 7 eap7-xml-security 2.0.8-2.redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454
Red Hat JBoss EAP 7 eap7-xom 1.2.10-2.redhat_1.1.ep7.el6 RHSA-2017:3455, RHSA-2017:3454

Affected packages

EcosystemPackageAffectedFixedRecord
Maven io.undertow:undertow-core >= 1.4.0, < 1.4.3.Final 1.4.3.Final GHSA-3f57-w2rp-72fc
Maven io.undertow:undertow-core < 1.3.25.Final 1.3.25.Final GHSA-3f57-w2rp-72fc

Advisories 6

References