Description
A path traversal vulnerability was found in Undertow. This issue may allow a remote attacker to append a specially-crafted sequence to an HTTP request for an application deployed to JBoss EAP, which may permit access to privileged or restricted files and directories.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | undertow | < 2.3.12 | 2.3.12 |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | — | — |
| Red Hat | Red Hat build of Quarkus | — | — |
| Red Hat | Red Hat Data Grid 8 | — | — |
| Red Hat | Red Hat Decision Manager 7 | — | — |
| Red Hat | Red Hat Fuse 7 | — | — |
| Red Hat | Red Hat JBoss Data Grid 7 | — | — |
| Red Hat | Red Hat JBoss Fuse 6 | — | — |
| Red Hat | Red Hat Process Automation 7 | — | — |
| Red Hat | Red Hat Single Sign-On 7 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | undertow | 2.3.18-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | undertow | No fix yet | — |
| Ubuntu 26.04 LTS | undertow | No fix yet | — |
| Ubuntu 25.10 | undertow | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | undertow | No fix yet | — |
| Ubuntu Pro 22.04 LTS | undertow | No fix yet | — |
| Ubuntu Pro 20.04 LTS | undertow | No fix yet | — |
| Ubuntu Pro 18.04 LTS | undertow | No fix yet | — |
| Ubuntu Pro 16.04 LTS | undertow | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 8 | eap8-undertow | 2.3.11-1.SP1_redhat_00001.1.el8eap | RHSA-2024:2764 |
| Red Hat JBoss EAP 7 | eap7-activemq-artemis +15 | 2.16.0-18.redhat_00052.1.el7eap | RHSA-2024:1676, RHSA-2024:1675, RHSA-2024:1674 |
| Red Hat JBoss EAP 7 | eap7-apache-cxf +3 | 3.4.10-2.redhat_00001.1.el7eap | RHSA-2024:1676, RHSA-2024:1675, RHSA-2024:1674 |
| Red Hat JBoss EAP 7 | eap7-eclipse-jgit | 5.13.3.202401111512-1.r_redhat_00001.1.el7eap | RHSA-2024:1676, RHSA-2024:1675, RHSA-2024:1674 |
| Red Hat JBoss EAP 7 | eap7-elytron-web +1 | 1.9.4-1.Final_redhat_00001.1.el7eap | RHSA-2024:1676, RHSA-2024:1675, RHSA-2024:1674 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.3.21-1.Final_redhat_00001.1.el7eap | RHSA-2024:1676, RHSA-2024:1675, RHSA-2024:1674 |
| Red Hat JBoss EAP 7 | eap7-hibernate +4 | 5.3.36-1.Final_redhat_00001.1.el7eap | RHSA-2024:1676, RHSA-2024:1675, RHSA-2024:1674 |
| Red Hat JBoss EAP 7 | eap7-infinispan +9 | 11.0.18-2.Final_redhat_00001.1.el7eap | RHSA-2024:1676, RHSA-2024:1675, RHSA-2024:1674 |
| Red Hat JBoss EAP 7 | eap7-jberet +1 | 1.3.9-3.SP3_redhat_00001.1.el7eap | RHSA-2024:1676, RHSA-2024:1675, RHSA-2024:1674 |
| Red Hat JBoss EAP 7 | eap7-jboss-annotations-api_1.3_spec | 2.0.1-3.Final_redhat_00001.1.el7eap | RHSA-2024:1676, RHSA-2024:1675, RHSA-2024:1674 |
| Red Hat JBoss EAP 7 | eap7-jboss-cert-helper +1 | 1.1.2-1.redhat_00001.1.el7eap | RHSA-2024:1676, RHSA-2024:1675, RHSA-2024:1674 |
| Red Hat JBoss EAP 7 | eap7-jboss-remoting | 5.0.27-4.SP2_redhat_00001.1.el7eap | RHSA-2024:1676, RHSA-2024:1675, RHSA-2024:1674 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +2 | 1.10.0-35.Final_redhat_00034.1.el7eap | RHSA-2024:1676, RHSA-2024:1675, RHSA-2024:1674 |
| Red Hat JBoss EAP 7 | eap7-jboss-xnio-base | 3.8.12-1.SP2_redhat_00001.1.el7eap | RHSA-2024:1676, RHSA-2024:1675, RHSA-2024:1674 |
| Red Hat JBoss EAP 7 | eap7-jgroups-kubernetes | 1.0.17-1.Final_redhat_00001.1.el7eap | RHSA-2024:1676, RHSA-2024:1675, RHSA-2024:1674 |
| Red Hat JBoss EAP 7 | eap7-lucene-core +7 | 5.5.5-6.redhat_2.1.el7eap | RHSA-2024:1676, RHSA-2024:1675, RHSA-2024:1674 |
| Red Hat JBoss EAP 7 | eap7-lucene-grouping | 5.5.5-6.redhat_2.1.el8eap | RHSA-2024:1675 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.2.30-1.SP1_redhat_00001.1.el7eap | RHSA-2024:1676, RHSA-2024:1675, RHSA-2024:1674 |
| Red Hat JBoss EAP 7 | eap7-wildfly +4 | 7.4.16-4.GA_redhat_00002.1.el7eap | RHSA-2024:1676, RHSA-2024:1675, RHSA-2024:1674 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron +1 | 1.15.22-1.Final_redhat_00001.1.el7eap | RHSA-2024:1676, RHSA-2024:1675, RHSA-2024:1674 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk17 | 7.4.16-4.GA_redhat_00002.1.el8eap | RHSA-2024:1676, RHSA-2024:1675 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | io.undertow:undertow-core | < 2.2.31.Final | 2.2.31.Final | GHSA-v76w-3ph8-vm66 |
| Maven | io.undertow:undertow-core | >= 2.3.0.Alpha1, < 2.3.12.Final | 2.3.12.Final | GHSA-v76w-3ph8-vm66 |
Advisories 6
- RHSA-2024:1675 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.16 Security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2024:1676 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.16 Security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2024:1674 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.16 Security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2024:2764 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0 security update Red Hat Security Advisories (RHSA) · Oct 8, 2026
- WID-SEC-2025-1459 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 3, 2025
- WID-SEC-2024-1084 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 24, 2025
References
- RHSA-2024:1674 vendor-advisory
- RHSA-2024:1675 vendor-advisory
- RHSA-2024:1676 vendor-advisory
- RHSA-2024:2763 vendor-advisory
- RHSA-2024:2764 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2024-1459 vdb-entry
- RHBZ#2259475 issue-tracking