https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T19:48:34.225486+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-77012 EUVD-2026-77012 2026-10-02T19:48:34.423243+00:00 EUVD-2026-77012 https://cve.radiocsirt.org/vuln/fkie_cve-2017-12196 fkie_cve-2017-12196 2026-10-02T19:48:34.423295+00:00

undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker to cause a MITM attack and access the desired content on the server.

 https://cve.radiocsirt.org/vuln/ghsa-cp7v-vmv7-6x2q GHSA-cp7v-vmv7-6x2q — Incorrect Authorization in Undertow 2026-10-02T19:48:34.423346+00:00

Affected: Maven: io.undertow:undertow-core

Undertow before versions 1.4.18.SP1 (not findable in Maven), 2.0.2.Final, and 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker to cause a MITM attack and access the desired content on the server.

 https://cve.radiocsirt.org/vuln/gsd-2017-12196 gsd-2017-12196 2026-10-02T19:48:34.423397+00:00 gsd-2017-12196 https://cve.radiocsirt.org/vuln/oesa-2025-1257 OESA-2025-1257 — undertow security update 2026-10-02T19:48:34.423426+00:00

Affected: openEuler:24.03-LTS-SP1: undertow, openEuler:20.03-LTS-SP4: undertow, openEuler:22.03-LTS-SP3: undertow, openEuler:22.03-LTS-SP4: undertow, openEuler:24.03-LTS: undertow

Java web server using non-blocking IO Security Fix(es):

undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker to cause a MITM attack and access the desired content on the server.(CVE-2017-12196)

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.(CVE-2019-10184)

A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user's credentials from the log files.(CVE-2019-10212)

 https://cve.radiocsirt.org/vuln/rhsa-2018:0478 RHSA-2018:0478 — Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.1 security update 2026-10-02T19:48:34.423507+00:00

resteasy: Vary header not added by CORS filter leading to cache poisoning artemis/hornetq: memory exhaustion via UDP and JGroups discovery undertow: Client can use bogus uri in Digest authentication infinispan: Unsafe deserialization of malicious object injected into data cache jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525) jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-15095) undertow: ALLOW_ENCODED_SLASH option not taken into account in the AjpRequestParser jackson-databind: unsafe deserialization due to incomplete blacklist (incomplete fix for CVE-2017-7525 and CVE-2017-17485)

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2017-12196 UBUNTU-CVE-2017-12196 2026-10-02T19:48:34.423562+00:00

Affected: Ubuntu:Pro:16.04:LTS: undertow, Ubuntu:Pro:18.04:LTS: undertow, Ubuntu:Pro:24.04:LTS: undertow

undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker to cause a MITM attack and access the desired content on the server.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2753 WID-SEC-W-2026-2753 — Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen 2026-10-02T19:48:34.423606+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat JBoss Enterprise Application Platform ausnutzen, um einen Denial of Service Angriff durchzuführen, Daten offenzulegen, Sicherheitsrestriktionen zu umgehen oder Code zur Ausführung zu bringen.