Most recent entries from all

cnvd-2019-24570

2026-10-02T21:56:07.246049+00:00

cnvd-2019-24570

EUVD-2026-53430

2026-10-02T21:56:07.246091+00:00

EUVD-2026-53430

fkie_cve-2019-10184

2026-10-02T21:56:07.246104+00:00

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.

GHSA-w69w-jvc7-wjgv — Undertow Missing Authorization when requesting a protected directory without trailing slash

2026-10-02T21:56:07.246133+00:00

Affected: Maven: io.undertow:undertow-servlet

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.

gsd-2019-10184

2026-10-02T21:56:07.246157+00:00

gsd-2019-10184

OESA-2025-1257 — undertow security update

2026-10-02T21:56:07.246168+00:00

Affected: openEuler:24.03-LTS-SP1: undertow, openEuler:20.03-LTS-SP4: undertow, openEuler:22.03-LTS-SP3: undertow, openEuler:22.03-LTS-SP4: undertow, openEuler:24.03-LTS: undertow

Java web server using non-blocking IO Security Fix(es):

undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker to cause a MITM attack and access the desired content on the server.(CVE-2017-12196)

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.(CVE-2019-10184)

A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user's credentials from the log files.(CVE-2019-10212)

RHSA-2019:2935 — Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.4 on RHEL 6 Security update

2026-10-02T21:56:07.246201+00:00

undertow: Information leak in requests for directories without trailing slashes codehaus: incomplete fix for unsafe deserialization in jackson-databind vulnerabilities undertow: DEBUG log for io.undertow.request.security if enabled leaks credentials to log files jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server. jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to remote code execution jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server via crafted JSON message. jackson-databind: default typing mishandling leading to remote code execution

UBUNTU-CVE-2019-10184

2026-10-02T21:56:07.246229+00:00

Affected: Ubuntu:Pro:16.04:LTS: undertow, Ubuntu:Pro:18.04:LTS: undertow, Ubuntu:20.04:LTS: undertow, Ubuntu:Pro:24.04:LTS: undertow, Ubuntu:25.10: undertow, Ubuntu:26.04:LTS: undertow

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.

WID-SEC-W-2026-2754 — Red Hat Produkte: Mehrere Schwachstellen

2026-10-02T21:56:07.246253+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Single Sign On, Red Hat OpenShift Application Runtimes, Red Hat OpenShift Container Platform, Red Hat JBoss Enterprise Application Platform und Red Hat Enterprise Linux ausnutzen, um Informationen offenzulegen oder beliebigen Programmcode auszuführen.