Description
A flaw was found in Undertow. A buffer leak on the incoming WebSocket PONG message may lead to memory exhaustion. This flaw allows an attacker to cause a denial of service. The highest threat from this vulnerability is availability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | undertow | Fixed in 2.2.10.Final, 2.0.40.Final | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | undertow | 2.2.10-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | undertow | No fix yet | — |
| Ubuntu 26.04 LTS | undertow | No fix yet | — |
| Ubuntu 25.10 | undertow | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | undertow | No fix yet | — |
| Ubuntu Pro 22.04 LTS | undertow | No fix yet | — |
| Ubuntu Pro 20.04 LTS | undertow | No fix yet | — |
| Ubuntu Pro 18.04 LTS | undertow | No fix yet | — |
| Ubuntu Pro 16.04 LTS | undertow | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-activemq-artemis +15 | 1.5.5.016-1.redhat_00001.1.ep7.el7 | RHSA-2025:4226 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-artemis-native +1 | 1:1.5.5.016-1.redhat_00001.1.ep7.el7 | RHSA-2025:4226 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jboss-xnio-base | 3.5.11-1.Final_redhat_00001.1.ep7.el7 | RHSA-2025:4226 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jsoup | 1.14.2-1.redhat_00002.1.ep7.el7 | RHSA-2025:4226 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-undertow | 1.4.18-14.SP13_redhat_00001.1.ep7.el7 | RHSA-2025:4226 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly +1 | 7.1.10-2.GA_redhat_00002.1.ep7.el7 | RHSA-2025:4226 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-woodstox-core | 5.0.3-2.redhat_00002.1.ep7.el7 | RHSA-2025:4226 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-xml-security | 2.0.10-2.redhat_00002.1.ep7.el7 | RHSA-2025:4226 |
| Red Hat JBoss EAP 7 | eap7-apache-commons-io | 2.10.0-1.redhat_00001.1.el6eap | RHSA-2021:3658, RHSA-2021:3656, RHSA-2021:3468 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.2.16-1.Final_redhat_00001.1.el6eap | RHSA-2021:3468, RHSA-2021:3467, RHSA-2021:3466 |
| Red Hat JBoss EAP 7 | eap7-hibernate +4 | 5.3.20-4.SP2_redhat_00001.1.el6eap | RHSA-2021:3468, RHSA-2021:3467, RHSA-2021:3466 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.4.35-1.Final_redhat_00001.1.el6eap | RHSA-2021:3468, RHSA-2021:3467, RHSA-2021:3466 |
| Red Hat JBoss EAP 7 | eap7-jakarta-el | 3.0.3-2.redhat_00006.1.el6eap | RHSA-2021:3658, RHSA-2021:3656, RHSA-2021:3468 |
| Red Hat JBoss EAP 7 | eap7-jberet +1 | 1.3.9-1.Final_redhat_00001.1.el6eap | RHSA-2021:3468, RHSA-2021:3467, RHSA-2021:3466 |
| Red Hat JBoss EAP 7 | eap7-jboss-remoting | 5.0.23-2.SP1_redhat_00001.1.el6eap | RHSA-2021:3468, RHSA-2021:3467, RHSA-2021:3466 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +21 | 1.7.2-9.Final_redhat_00010.1.el6eap | RHSA-2021:3468, RHSA-2021:3467, RHSA-2021:3466 |
| Red Hat JBoss EAP 7 | eap7-narayana +10 | 5.9.12-1.Final_redhat_00001.1.el6eap | RHSA-2021:3468, RHSA-2021:3467, RHSA-2021:3466 |
| Red Hat JBoss EAP 7 | eap7-netty +1 | 4.1.63-1.Final_redhat_00001.1.el7eap | RHSA-2021:3658, RHSA-2021:3656 |
| Red Hat JBoss EAP 7 | eap7-picketbox +1 | 5.0.3-9.Final_redhat_00008.1.el6eap | RHSA-2021:3468, RHSA-2021:3467, RHSA-2021:3466 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.0.38-2.SP2_redhat_00001.1.el6eap | RHSA-2021:3658, RHSA-2021:3656, RHSA-2021:3468 |
| Red Hat JBoss EAP 7 | eap7-velocity +1 | 2.3.0-1.redhat_00001.1.el7eap | RHSA-2021:3658, RHSA-2021:3656 |
| Red Hat JBoss EAP 7 | eap7-wildfly +2 | 7.3.9-2.GA_redhat_00002.1.el6eap | RHSA-2021:3658, RHSA-2021:3656, RHSA-2021:3468 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron +1 | 1.15.5-1.Final_redhat_00001.1.el7eap | RHSA-2021:3658, RHSA-2021:3656 |
| Red Hat JBoss EAP 7 | eap7-wildfly-http-client +4 | 1.0.29-1.Final_redhat_00002.1.el6eap | RHSA-2021:3468, RHSA-2021:3467, RHSA-2021:3466 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk8 +1 | 7.3.9-2.GA_redhat_00002.1.el7eap | RHSA-2021:3656, RHSA-2021:3467 |
| Red Hat JBoss EAP 7 | eap7-wildfly-transaction-client | 1.1.14-2.Final_redhat_00001.1.el6eap | RHSA-2021:3468, RHSA-2021:3467, RHSA-2021:3466 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | io.undertow:undertow-core | < 2.0.40 | 2.0.40 | GHSA-fj7c-vg2v-ccrm |
| Maven | io.undertow:undertow-core | >= 2.2.0, < 2.2.10 | 2.2.10 | GHSA-fj7c-vg2v-ccrm |
Advisories 11
- RHSA-2025:4226 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.10 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2021:3658 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.1 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:3656 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.1 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:3468 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.9 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:3467 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.9 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:3466 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.9 security update on RHEL 6 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:3219 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4 security update Red Hat Security Advisories (RHSA) · Sep 8, 2026
- RHSA-2021:3217 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3 security update Red Hat Security Advisories (RHSA) · Sep 8, 2026
- WID-SEC-2025-1459 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 3, 2025
- WID-SEC-2022-0916 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 24, 2025
- WID-SEC-2025-0888 Red Hat JBoss Enterprise Application Platform: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Apr 27, 2025