Unscored CVE-2022-1259 EUVD-2022-24592GHSA-5837-3xvj-5g8r

A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial…

Published Aug 31, 2022 · Updated Aug 2, 2024 · Assigned by redhat

Package: undertow Ecosystem: Ubuntu

Description

A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server. This flaw exists because of an incomplete fix for CVE-2021-3629.

Affected products

Vendor	Product	Affected	Fixed
—	undertow	Fixed in 2.3.0.Final, 2.2.17.SP1, 2.2.20.Final, 2.2.19.SP1.	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 26.10	undertow	No fix yet	—
Ubuntu 26.04 LTS	undertow	No fix yet	—
Ubuntu 25.10	undertow	No fix yet	—

Show 5 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 24.04 LTS	undertow	No fix yet	—
Ubuntu Pro 22.04 LTS	undertow	No fix yet	—
Ubuntu Pro 20.04 LTS	undertow	No fix yet	—
Ubuntu Pro 18.04 LTS	undertow	No fix yet	—
Ubuntu Pro 16.04 LTS	undertow	No fix yet	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-glassfish-el +1	3.0.1-4.b08_redhat_00005.1.ep7.el7	RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-hibernate +5	5.1.17-3.Final_redhat_00004.1.ep7.el7	RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-jackson-core +4	2.10.4-3.redhat_00006.1.el7eap	RHSA-2025:9583
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-jackson-databind	2.8.11.6-3.SP1_redhat_00003.1.ep7.el7	RHSA-2025:9583, RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-jackson-datatype-jdk8 +2	2.10.4-2.redhat_00006.1.el7eap	RHSA-2025:9583
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-jackson-modules-base +1	2.10.4-5.redhat_00006.1.el7eap	RHSA-2025:9583
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-jboss-ejb-client	4.0.12-1.Final_redhat_00002.1.ep7.el7	RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-jboss-server-migration +21	1.7.2-16.Final_redhat_00017.1.el7eap	RHSA-2025:9583
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-netty +1	4.1.63-2.Final_redhat_00003.1.ep7.el7	RHSA-2025:9583, RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-undertow	1.4.18-16.SP14_redhat_00001.1.ep7.el7	RHSA-2025:9583, RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-wildfly +1	7.1.11-4.GA_redhat_00002.1.ep7.el7	RHSA-2025:9583, RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-wildfly-elytron	1.1.14-1.Final_redhat_00001.1.ep7.el7	RHSA-2025:9583, RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-wildfly-elytron-tool	1.10.17-1.Final_redhat_00001.1.el7eap	RHSA-2025:9583
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-wildfly-http-client +4	1.0.21-1.Final_redhat_00001.1.ep7.el7	RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-wildfly-javadocs +2	7.3.14-3.GA_redhat_00002.1.el7eap	RHSA-2025:9583
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-wildfly-naming-client	1.0.13-1.Final_redhat_00001.1.ep7.el7	RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-wildfly-openssl +1	1.0.12-1.Final_redhat_00001.1.ep7.el7	RHSA-2025:9582
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-wildfly-openssl-linux	1.0.12-6.Final_redhat_00001.1.ep7.el7	RHSA-2025:9582
Red Hat JBoss EAP 7	eap7-snakeyaml	1.31.0-1.redhat_00001.1.el7eap	RHSA-2022:6823, RHSA-2022:6822, RHSA-2022:6821
Red Hat JBoss EAP 7	eap7-undertow	2.2.19-1.SP2_redhat_00001.1.el7eap	RHSA-2022:6823, RHSA-2022:6822, RHSA-2022:6821

Advisories 8

RHSA-2025:9583 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.14 Security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
RHSA-2025:9582 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.11 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
RHSA-2022:6823 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.7 Security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
RHSA-2022:6821 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.7 Security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
RHSA-2022:6822 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.7 Security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
WID-SEC-2022-0607 Red Hat FUSE: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 9, 2026
WID-SEC-2025-1459 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 3, 2025
WID-SEC-2023-1755 IBM InfoSphere Information Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 16, 2023

References