Description
A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. This flaw allows an attacker to carry out denial of service attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | undertow | Fixed in 2.2.15.Final | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | undertow | 2.2.16-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | undertow | No fix yet | — |
| Ubuntu 26.04 LTS | undertow | No fix yet | — |
| Ubuntu 25.10 | undertow | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | undertow | No fix yet | — |
| Ubuntu Pro 22.04 LTS | undertow | No fix yet | — |
| Ubuntu Pro 20.04 LTS | undertow | No fix yet | — |
| Ubuntu Pro 18.04 LTS | undertow | No fix yet | — |
| Ubuntu Pro 16.04 LTS | undertow | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Single Sign On 7 | rh-sso7-keycloak +1 | 15.0.4-1.redhat_00003.1.el7sso | RHSA-2022:0448, RHSA-2022:0447 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-activemq-artemis +15 | 1.5.5.016-1.redhat_00001.1.ep7.el7 | RHSA-2025:4226 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-apache-cxf +3 | 3.4.10-1.SP1_redhat_00001.1.el7eap | RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-artemis-native +1 | 1:1.5.5.016-1.redhat_00001.1.ep7.el7 | RHSA-2025:4226 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-avro | 1.7.6-8.redhat_00003.1.el7eap | RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-h2database | 1.4.197-3.redhat_00004.1.el7eap | RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jboss-annotations-api_1.3_spec | 2.0.1-4.Final_redhat_00001.1.el7eap | RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jboss-marshalling +1 | 2.0.15-1.Final_redhat_00001.1.el7eap | RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jboss-server-migration +21 | 1.7.2-12.Final_redhat_00013.1.el7eap | RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jboss-xnio-base | 3.5.11-1.Final_redhat_00001.1.ep7.el7 | RHSA-2025:4226, RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jsoup | 1.14.2-1.redhat_00002.1.ep7.el7 | RHSA-2025:4226 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-log4j-jboss-logmanager | 1.2.2-2.Final_redhat_00002.1.el7eap | RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-undertow | 1.4.18-14.SP13_redhat_00001.1.ep7.el7 | RHSA-2025:4226 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly +1 | 7.1.10-2.GA_redhat_00002.1.ep7.el7 | RHSA-2025:4226, RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly-javadocs +2 | 7.3.11-4.GA_redhat_00002.1.el7eap | RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-woodstox-core | 5.0.3-2.redhat_00002.1.ep7.el7 | RHSA-2025:4226 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wss4j +6 | 2.3.3-2.redhat_00001.1.el7eap | RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-xalan-j2 | 2.7.1-38.redhat_00015.1.el7eap | RHSA-2024:10207 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-xml-security | 2.0.10-2.redhat_00002.1.ep7.el7 | RHSA-2025:4226, RHSA-2024:10207 |
| Red Hat JBoss EAP 7 | eap7-hornetq +3 | 2.4.8-1.Final_redhat_00001.1.el7eap | RHSA-2022:0401, RHSA-2022:0400 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.0.41-2.SP2_redhat_00001.1.el6eap | RHSA-2022:0405, RHSA-2022:0401, RHSA-2022:0400 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | io.undertow:undertow-core | < 2.2.15 | 2.2.15 | GHSA-339q-62wm-c39w |
Advisories 11
- RHSA-2024:10207 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.11 Security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2025:4226 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.10 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2022:0448 Red Hat Security Advisory: Red Hat Single Sign-On 7.5.1 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:0447 Red Hat Security Advisory: Red Hat Single Sign-On 7.5.1 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:0401 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.3 security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- RHSA-2022:0405 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3 security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- RHSA-2022:0400 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.3 security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- WID-SEC-2022-0607 Red Hat FUSE: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 9, 2026
- WID-SEC-2022-1375 JFrog Artifactory: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 12, 2025
- WID-SEC-2025-1459 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 3, 2025
- WID-SEC-2024-3532 Red Hat JBoss Enterprise Application Platform: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Apr 27, 2025
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2010378
- https://issues.redhat.com/browse/UNDERTOW-1979
- https://github.com/undertow-io/undertow/pull/1296
- https://github.com/undertow-io/undertow/commit/e43f0ada3f4da6e8579e0020cec3cb1a81e487c2
- https://access.redhat.com/security/cve/CVE-2021-3859
- https://security.netapp.com/advisory/ntap-20221201-0004/