Skip to content
OpenAdvisories
High · 7.5 CVE-2020-27782 EUVD-2022-1173GHSA-rhcw-wjcm-9h6g

Denial of service in Undertow

Published Feb 23, 2021 · Updated Aug 4, 2024 · Assigned by redhat

Package: io.undertow:undertow-core Package: undertow Package: undertow Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu

Description

A flaw was found in the Undertow AJP connector. Malicious requests and abrupt connection closes could be triggered by an attacker using query strings with non-RFC compliant characters resulting in a denial of service. The highest threat from this vulnerability is to system availability. This affects Undertow 2.1.5.SP1, 2.0.33.SP2, and 2.2.3.SP1.

Affected products

VendorProductAffectedFixed
— Undertow 2.1.5.SP1, 2.0.33.SP2, 2.2.3.SP1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 undertow 2.2.4-1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 undertow No fix yet —
Ubuntu 26.04 LTS undertow No fix yet —
Ubuntu 25.10 undertow No fix yet —
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS undertow No fix yet —
Ubuntu Pro 22.04 LTS undertow No fix yet —
Ubuntu Pro 20.04 LTS undertow No fix yet —
Ubuntu Pro 18.04 LTS undertow No fix yet —
Ubuntu Pro 16.04 LTS undertow No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-glassfish-el +1 3.0.1-4.b08_redhat_00005.1.ep7.el7 RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-hibernate +5 5.1.17-3.Final_redhat_00004.1.ep7.el7 RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-jackson-databind 2.8.11.6-3.SP1_redhat_00003.1.ep7.el7 RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-jboss-ejb-client 4.0.12-1.Final_redhat_00002.1.ep7.el7 RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-netty +1 4.1.63-2.Final_redhat_00003.1.ep7.el7 RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-undertow 1.4.18-16.SP14_redhat_00001.1.ep7.el7 RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly +1 7.1.11-4.GA_redhat_00002.1.ep7.el7 RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly-elytron 1.1.14-1.Final_redhat_00001.1.ep7.el7 RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly-http-client +4 1.0.21-1.Final_redhat_00001.1.ep7.el7 RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly-naming-client 1.0.13-1.Final_redhat_00001.1.ep7.el7 RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly-openssl +1 1.0.12-1.Final_redhat_00001.1.ep7.el7 RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7 eap7-wildfly-openssl-linux 1.0.12-6.Final_redhat_00001.1.ep7.el7 RHSA-2025:9582
Red Hat JBoss EAP 7 eap7-activemq-artemis +15 2.9.0-7.redhat_00017.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-glassfish-jsf 2.3.9-12.SP13_redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-hal-console 3.2.12-1.Final_redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-hibernate +4 5.3.20-1.Final_redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-httpcomponents-client 4.5.13-1.redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-jboss-ejb-client 4.0.37-1.Final_redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-jboss-genericjms 2.0.8-1.Final_redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-jboss-modules 1.11.0-1.Final_redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-jboss-remoting 5.0.20-1.Final_redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-jboss-server-migration +21 1.7.2-4.Final_redhat_00005.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-jboss-xnio-base 3.7.12-1.Final_redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-narayana +10 5.9.10-1.Final_redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-opentracing-interceptors 0.0.4.1-2.redhat_00002.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-resteasy +19 3.11.3-1.Final_redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-undertow 2.0.33-1.SP2_redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-wildfly +2 7.3.5-2.GA_redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-wildfly-discovery +1 1.2.1-1.Final_redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-wildfly-elytron +1 1.10.10-1.Final_redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-wildfly-http-client +4 1.0.24-1.Final_redhat_00001.1.el6eap RHSA-2021:0248, RHSA-2021:0247, RHSA-2021:0246
Red Hat JBoss EAP 7 eap7-wildfly-java-jdk8 +1 7.3.5-2.GA_redhat_00001.1.el7eap RHSA-2021:0247

Affected packages

EcosystemPackageAffectedFixedRecord
Maven io.undertow:undertow-core >= 2.1.0, < 2.1.5 2.1.5 GHSA-rhcw-wjcm-9h6g
Maven io.undertow:undertow-core < 2.0.33 2.0.33 GHSA-rhcw-wjcm-9h6g

Advisories 5

References