Description
A flaw was found in Undertow. A potential security issue in flow control handling by the browser over http/2 may potentially cause overhead or a denial of service in the server. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.40.Final and prior to 2.2.11.Final.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | undertow | undertow 2.0.40.Final, undertow 2.2.11.Final | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | undertow | 2.2.12-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | undertow | No fix yet | — |
| Ubuntu 26.04 LTS | undertow | No fix yet | — |
| Ubuntu 25.10 | undertow | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | undertow | No fix yet | — |
| Ubuntu Pro 22.04 LTS | undertow | No fix yet | — |
| Ubuntu Pro 20.04 LTS | undertow | No fix yet | — |
| Ubuntu Pro 18.04 LTS | undertow | No fix yet | — |
| Ubuntu Pro 16.04 LTS | undertow | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 7 | eap7-apache-cxf +3 | 3.3.12-1.redhat_00001.1.el6eap | RHSA-2021:5151, RHSA-2021:5150, RHSA-2021:5149 |
| Red Hat JBoss EAP 7 | eap7-apache-sshd | 2.7.0-1.redhat_00001.1.el7eap | RHSA-2021:4677, RHSA-2021:4676 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.5.3-1.Final_redhat_00001.1.el6eap | RHSA-2021:5151, RHSA-2021:5150, RHSA-2021:5149 |
| Red Hat JBoss EAP 7 | eap7-jakarta-el | 3.0.3-3.redhat_00007.1.el6eap | RHSA-2021:5151, RHSA-2021:5150, RHSA-2021:5149 |
| Red Hat JBoss EAP 7 | eap7-jboss-ejb-client | 4.0.43-1.Final_redhat_00001.1.el6eap | RHSA-2021:5151, RHSA-2021:5150, RHSA-2021:5149 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +21 | 1.7.2-10.Final_redhat_00011.1.el6eap | RHSA-2021:5151, RHSA-2021:5150, RHSA-2021:5149 |
| Red Hat JBoss EAP 7 | eap7-jsoup | 1.14.2-1.redhat_00002.1.el6eap | RHSA-2021:5151, RHSA-2021:5150, RHSA-2021:5149 |
| Red Hat JBoss EAP 7 | eap7-resteasy +19 | 3.11.5-1.Final_redhat_00001.1.el6eap | RHSA-2021:5151, RHSA-2021:5150, RHSA-2021:5149 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.0.41-1.SP1_redhat_00001.1.el6eap | RHSA-2021:5151, RHSA-2021:5150, RHSA-2021:5149 |
| Red Hat JBoss EAP 7 | eap7-wildfly +2 | 7.3.10-2.GA_redhat_00003.1.el6eap | RHSA-2021:5151, RHSA-2021:5150, RHSA-2021:5149 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron +1 | 1.10.15-1.Final_redhat_00001.1.el6eap | RHSA-2021:5151, RHSA-2021:5150, RHSA-2021:5149 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk8 +1 | 7.3.10-2.GA_redhat_00003.1.el7eap | RHSA-2021:5150, RHSA-2021:4676 |
| Red Hat JBoss EAP 7 | eap7-wss4j +6 | 2.2.7-1.redhat_00001.1.el6eap | RHSA-2021:5151, RHSA-2021:5150, RHSA-2021:5149 |
| Red Hat JBoss EAP 7 | eap7-xml-security | 2.1.7-1.redhat_00001.1.el6eap | RHSA-2021:5151, RHSA-2021:5150, RHSA-2021:5149 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | io.undertow:undertow-core | < 2.0.40.Final | 2.0.40.Final | GHSA-rf6q-vx79-mjxr |
| Maven | io.undertow:undertow-core | >= 2.1.0, < 2.2.11.Final | 2.2.11.Final | GHSA-rf6q-vx79-mjxr |
Advisories 8
- RHSA-2021:5151 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.10 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:5150 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.10 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:5149 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.10 security update on RHEL 6 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:4677 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.2 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:4676 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.2 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- WID-SEC-2022-0607 Red Hat FUSE: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 9, 2026
- WID-SEC-2025-1459 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 3, 2025
- WID-SEC-2022-0726 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Jun 24, 2025