Skip to content
OpenAdvisories
High · 7.5 CVE-2019-14888 EUVD-2022-5375GHSA-vjxc-frw4-jmh5

Undertow vulnerable to Uncontrolled Resource Consumption

Published Jan 23, 2020 · Updated Aug 5, 2024 · Assigned by redhat

Vendor: Red Hat Product: undertow Package: io.undertow:undertow-core Package: undertow Package: undertow Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu

Description

A vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS. An attacker can target the HTTPS port to carry out a Denial Of Service (DOS) to make the service unavailable on SSL.

Affected products

VendorProductAffectedFixed
Red Hat undertow All versions before 2.0.28.SP1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 undertow 2.0.30-1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 undertow No fix yet —
Ubuntu 26.04 LTS undertow No fix yet —
Ubuntu 25.10 undertow No fix yet —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS undertow No fix yet —
Ubuntu Pro 22.04 LTS undertow No fix yet —
Ubuntu Pro 20.04 LTS undertow No fix yet —
Ubuntu Pro 18.04 LTS undertow No fix yet —
Ubuntu Pro 16.04 LTS undertow No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-apache-commons-beanutils 1.9.4-1.redhat_00002.1.ep7.el7 RHSA-2024:5856
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-infinispan +5 8.2.11-1.SP2_redhat_00001.1.ep7.el7 RHSA-2024:5856
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-jackson-databind 2.8.11.5-1.redhat_00001.1.ep7.el7 RHSA-2024:5856
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-log4j-jboss-logmanager 1.2.2-1.Final_redhat_00002.1.ep7.el7 RHSA-2024:5856
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-netty +1 4.1.45-1.Final_redhat_00001.1.ep7.el7 RHSA-2024:5856
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-undertow 1.4.18-12.SP12_redhat_00001.1.ep7.el7 RHSA-2024:5856
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly +1 7.1.7-2.GA_redhat_00002.1.ep7.el7 RHSA-2024:5856
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly-elytron 1.1.13-1.Final_redhat_00001.1.ep7.el7 RHSA-2024:5856
Red Hat JBoss EAP 7 eap7-apache-cxf +3 3.2.11-1.redhat_00001.1.el6eap RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159
Red Hat JBoss EAP 7 eap7-glassfish-jsf 2.3.5-6.SP3_redhat_00004.1.el6eap RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159
Red Hat JBoss EAP 7 eap7-hal-console 3.0.19-1.Final_redhat_00001.1.el6eap RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159
Red Hat JBoss EAP 7 eap7-hibernate +4 5.3.14-1.Final_redhat_00001.1.el6eap RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159
Red Hat JBoss EAP 7 eap7-hibernate-validator +1 6.0.18-1.Final_redhat_00001.1.el6eap RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159
Red Hat JBoss EAP 7 eap7-jackson-core +9 2.9.10-1.redhat_00003.1.el6eap RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159
Red Hat JBoss EAP 7 eap7-jackson-databind 2.9.10.1-1.redhat_00001.1.el6eap RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159
Red Hat JBoss EAP 7 eap7-jackson-modules-base +1 2.9.10-2.redhat_00003.1.el6eap RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159
Red Hat JBoss EAP 7 eap7-jberet +1 1.3.5-1.Final_redhat_00001.1.el6eap RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159
Red Hat JBoss EAP 7 eap7-jboss-ejb-client 4.0.27-1.Final_redhat_00001.1.el6eap RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159
Red Hat JBoss EAP 7 eap7-jboss-jsf-api_2.3_spec 2.3.5-3.SP2_redhat_00001.1.el6eap RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159
Red Hat JBoss EAP 7 eap7-jboss-server-migration +23 1.3.1-7.Final_redhat_00007.1.el6eap RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159
Red Hat JBoss EAP 7 eap7-jboss-xnio-base 3.7.6-3.SP2_redhat_00001.1.el6eap RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159
Red Hat JBoss EAP 7 eap7-netty +1 4.1.42-1.Final_redhat_00001.1.el6eap RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159
Red Hat JBoss EAP 7 eap7-picketlink-bindings +1 2.5.5-21.SP12_redhat_00010.1.el6eap RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159
Red Hat JBoss EAP 7 eap7-undertow 2.0.28-2.SP1_redhat_00001.1.el6eap RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159
Red Hat JBoss EAP 7 eap7-undertow-jastow 2.0.8-1.Final_redhat_00001.1.el6eap RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159
Red Hat JBoss EAP 7 eap7-weld-ejb +6 3.0.6-3.Final_redhat_00003.1.el6eap RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159
Red Hat JBoss EAP 7 eap7-wildfly +2 7.2.6-5.GA_redhat_00001.1.el6eap RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159
Red Hat JBoss EAP 7 eap7-wildfly-http-client +4 1.0.18-2.Final_redhat_00001.1.el6eap RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159
Red Hat JBoss EAP 7 eap7-wildfly-java-jdk8 +1 7.2.6-5.GA_redhat_00001.1.el7eap RHSA-2020:0160
Red Hat JBoss EAP 7 eap7-wildfly-transaction-client 1.1.8-1.Final_redhat_00001.1.el6eap RHSA-2020:0161, RHSA-2020:0160, RHSA-2020:0159

Affected packages

EcosystemPackageAffectedFixedRecord
Maven io.undertow:undertow-core < 2.0.29.Final 2.0.29.Final GHSA-vjxc-frw4-jmh5

Advisories 5

References