Description
A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from request other than their own. The highest threat from this vulnerability is to data confidentiality and integrity.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | undertow | Undertow 2.2.0.Final, Undertow 2.1.6.Final, Undertow 2.0.34.Final | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | undertow | 2.2.0-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | undertow | No fix yet | — |
| Ubuntu 26.04 LTS | undertow | No fix yet | — |
| Ubuntu 25.10 | undertow | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | undertow | No fix yet | — |
| Ubuntu Pro 22.04 LTS | undertow | No fix yet | — |
| Ubuntu Pro 20.04 LTS | undertow | No fix yet | — |
| Ubuntu Pro 18.04 LTS | undertow | No fix yet | — |
| Ubuntu Pro 16.04 LTS | undertow | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 7 | eap7-activemq-artemis +15 | 2.9.0-9.redhat_00019.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
| Red Hat JBoss EAP 7 | eap7-bouncycastle +3 | 1.68.0-1.redhat_00001.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
| Red Hat JBoss EAP 7 | eap7-guava +1 | 30.1.0-1.redhat_00001.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
| Red Hat JBoss EAP 7 | eap7-guava-failureaccess | 1.0.1-1.redhat_00002.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.2.13-1.Final_redhat_00001.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.4.27-1.Final_redhat_00001.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
| Red Hat JBoss EAP 7 | eap7-jboss-ejb-client | 4.0.39-1.SP1_redhat_00001.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
| Red Hat JBoss EAP 7 | eap7-jboss-logmanager | 2.1.18-1.Final_redhat_00001.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
| Red Hat JBoss EAP 7 | eap7-jboss-remoting | 5.0.20-2.SP1_redhat_00001.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +21 | 1.7.2-5.Final_redhat_00006.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
| Red Hat JBoss EAP 7 | eap7-narayana +10 | 5.9.11-1.Final_redhat_00001.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.0.34-1.SP1_redhat_00001.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
| Red Hat JBoss EAP 7 | eap7-wildfly +2 | 7.3.6-1.GA_redhat_00002.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron +1 | 1.10.11-1.Final_redhat_00001.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
| Red Hat JBoss EAP 7 | eap7-wildfly-http-client +4 | 1.0.25-1.Final_redhat_00001.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk8 +1 | 7.3.6-1.GA_redhat_00002.1.el7eap | RHSA-2021:0873 |
| Red Hat JBoss EAP 7 | eap7-wildfly-naming-client | 1.0.14-1.Final_redhat_00001.1.el6eap | RHSA-2021:0874, RHSA-2021:0873, RHSA-2021:0872 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | io.undertow:undertow-core | >= 2.1.0, < 2.1.6 | 2.1.6 | GHSA-qjwc-v72v-fq6r |
| Maven | io.undertow:undertow-core | < 2.0.34 | 2.0.34 | GHSA-qjwc-v72v-fq6r |
Advisories 4
- RHSA-2021:0873 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.6 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:0874 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.6 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:0872 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.6 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- WID-SEC-2023-1272 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 7, 2025