Most recent entries from all

cnvd-2018-17729

EUVD-2026-76952

fkie_cve-2017-12165

It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling.

GHSA-5gg7-5wv8-4gcj — Undertow Request Smuggling vulnerability

Affected: Maven: io.undertow:undertow-core

It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling.

gsd-2017-12165

RHSA-2017:3454 — Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.0 security update

Artemis: Deserialization of untrusted input vulnerability eap: HTTP header injection / response splitting EAP7 Privilege escalation when managing domain including earlier version slaves EAP7: Internal IP address disclosed on redirect when request header Host field is not set undertow: Long URL proxy request lead to java.nio.BufferOverflowException and DoS EAP: Sensitive data can be exposed at the server level in domain mode admin-cli: Potential EAP resource starvation DOS attack via GET requests for server log files jboss: jbossas: unsafe chown of server.log in jboss init script allows privilege escalation wildfly: ParseState headerValuesCache can be exploited to fill heap with garbage wildfly: Arbitrary file read via path traversal undertow: HTTP Request smuggling vulnerability due to permitting invalid characters in HTTP requests undertow: IO thread DoS via unclean Websocket closing jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper hibernate-validator: Privilege escalation when running under the security manager undertow: HTTP Request smuggling vulnerability (incomplete fix of CVE-2017-2666) undertow: improper whitespace parsing leading to potential HTTP request smuggling EAP-7: Wrong privileges on multiple property files

UBUNTU-CVE-2017-12165

Affected: Ubuntu:Pro:16.04:LTS: undertow, Ubuntu:Pro:18.04:LTS: undertow, Ubuntu:20.04:LTS: undertow, Ubuntu:Pro:24.04:LTS: undertow, Ubuntu:25.10: undertow, Ubuntu:26.04:LTS: undertow

It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling.