CVE-2022-1319

Description

A flaw was found in Undertow. For an AJP 400 response, EAP 7 is improperly sending two response packets, and those packets have the reuse flag set even though JBoss EAP closes the connection. A failure occurs when the connection is reused after a 400 by CPING since it reads in the second SEND_HEADERS response packet instead of a CPONG.

Affected products

Vendor	Product	Affected	Fixed
—	undertow	Fixed in 2.3.0.Final, 2.2.18.Final, 2.2.17.SP3, 2.2.17.SP4, 2.3.0.Alpha2	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	undertow	2.2.17-1	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu Pro 24.04 LTS	undertow	No fix yet	—
Ubuntu Pro 22.04 LTS	undertow	No fix yet	—
Ubuntu Pro 20.04 LTS	undertow	No fix yet	—

Show 2 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 18.04 LTS	undertow	No fix yet	—
Ubuntu Pro 16.04 LTS	undertow	No fix yet	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
Red Hat Single Sign On 7	rh-sso7 +1	1-5.el9sso	RHSA-2022:7411
Red Hat Single Sign On 7	rh-sso7-javapackages-tools +2	6.0.0-7.el9sso	RHSA-2022:7411
Red Hat Single Sign On 7	rh-sso7-keycloak +1	18.0.3-1.redhat_00001.1.el7sso	RHSA-2022:7411, RHSA-2022:7410, RHSA-2022:7409
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-activemq-artemis +15	1.5.5.016-1.redhat_00001.1.ep7.el7	RHSA-2025:4226
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-artemis-native +1	1:1.5.5.016-1.redhat_00001.1.ep7.el7	RHSA-2025:4226
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-jackson-core +4	2.10.4-3.redhat_00006.1.el7eap	RHSA-2025:9583
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-jackson-databind +2	2.10.4-5.redhat_00006.1.el7eap	RHSA-2025:9583
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-jackson-datatype-jdk8 +2	2.10.4-2.redhat_00006.1.el7eap	RHSA-2025:9583
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-jboss-server-migration +21	1.7.2-16.Final_redhat_00017.1.el7eap	RHSA-2025:9583
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-jboss-xnio-base	3.5.11-1.Final_redhat_00001.1.ep7.el7	RHSA-2025:4226
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-jsoup	1.14.2-1.redhat_00002.1.ep7.el7	RHSA-2025:4226
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-netty +1	4.1.63-5.Final_redhat_00003.1.el7eap	RHSA-2025:9583
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-undertow	1.4.18-14.SP13_redhat_00001.1.ep7.el7	RHSA-2025:9583, RHSA-2025:4226
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-wildfly +1	7.1.10-2.GA_redhat_00002.1.ep7.el7	RHSA-2025:9583, RHSA-2025:4226
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-wildfly-elytron +1	1.10.17-1.Final_redhat_00001.1.el7eap	RHSA-2025:9583
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-wildfly-javadocs +2	7.3.14-3.GA_redhat_00002.1.el7eap	RHSA-2025:9583
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-woodstox-core	5.0.3-2.redhat_00002.1.ep7.el7	RHSA-2025:4226
Red Hat Jboss Enterprise Application Platform Eus 7	eap7-xml-security	2.0.10-2.redhat_00002.1.ep7.el7	RHSA-2025:4226
Red Hat JBoss EAP 7	eap7-activemq-artemis +15	2.16.0-9.redhat_00042.1.el7eap	RHSA-2022:4919, RHSA-2022:4918
Red Hat JBoss EAP 7	eap7-h2database	1.4.197-2.redhat_00004.1.el7eap	RHSA-2022:4919, RHSA-2022:4918
Red Hat JBoss EAP 7	eap7-hal-console	3.3.12-1.Final_redhat_00001.1.el7eap	RHSA-2022:4919, RHSA-2022:4918
Red Hat JBoss EAP 7	eap7-jackson-databind	2.12.6.1-1.redhat_00003.1.el7eap	RHSA-2022:4919, RHSA-2022:4918
Red Hat JBoss EAP 7	eap7-jboss-xnio-base	3.8.7-1.SP1_redhat_00001.1.el7eap	RHSA-2022:4919, RHSA-2022:4918
Red Hat JBoss EAP 7	eap7-netty +27	4.1.72-4.Final_redhat_00001.1.el7eap	RHSA-2022:4919, RHSA-2022:4918
Red Hat JBoss EAP 7	eap7-undertow	2.2.17-2.SP4_redhat_00001.1.el7eap	RHSA-2022:4919, RHSA-2022:4918
Red Hat JBoss EAP 7	eap7-wildfly +4	7.4.5-3.GA_redhat_00001.1.el7eap	RHSA-2022:4919, RHSA-2022:4918
Red Hat JBoss EAP 7	eap7-wildfly-http-client +4	1.1.11-1.SP1_redhat_00001.1.el7eap	RHSA-2022:4919, RHSA-2022:4918
Red Hat JBoss EAP 7	eap7-xerces-j2	2.12.0-3.SP04_redhat_00001.1.el7eap	RHSA-2022:4919, RHSA-2022:4918

Advisories 10

RHSA-2025:9583 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.14 Security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
RHSA-2025:4226 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.10 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
RHSA-2022:7411 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.1 security update on RHEL 9 Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2022:7409 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.1 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2022:7410 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.1 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2022:4919 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.5 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Oct 13, 2026
RHSA-2022:4918 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.5 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 13, 2026
WID-SEC-2022-0607 Red Hat FUSE: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 9, 2026
WID-SEC-2025-1459 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 3, 2025
WID-SEC-2023-0137 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 21, 2024

A flaw was found in Undertow. For an AJP 400 response, EAP 7 is improperly sending two response packets, and those packets have the reuse f…

Description

Affected products

Fixed in Linux distributions

Debian

Ubuntu

Red Hat

Advisories 10

References