https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 19:48:35 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-77012 EUVD-2026-77012 https://cve.radiocsirt.org/vuln/euvd-2026-77012 https://cve.radiocsirt.org/vuln/fkie_cve-2017-12196 <p>undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker to cause a MITM attack and access the desired content on the server.</p> <p>undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker to cause a MITM attack and access the desired content on the server.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2017-12196 https://cve.radiocsirt.org/vuln/ghsa-cp7v-vmv7-6x2q <p><strong>Affected:</strong> Maven: io.undertow:undertow-core</p> <p>Undertow before versions 1.4.18.SP1 (not findable in Maven), 2.0.2.Final, and 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker to cause a MITM attack and access the desired content on the server.</p> <p><strong>Affected:</strong> Maven: io.undertow:undertow-core</p> <p>Undertow before versions 1.4.18.SP1 (not findable in Maven), 2.0.2.Final, and 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker to cause a MITM attack and access the desired content on the server.</p> https://cve.radiocsirt.org/vuln/ghsa-cp7v-vmv7-6x2q https://cve.radiocsirt.org/vuln/gsd-2017-12196 gsd-2017-12196 https://cve.radiocsirt.org/vuln/gsd-2017-12196 https://cve.radiocsirt.org/vuln/oesa-2025-1257 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: undertow, openEuler:20.03-LTS-SP4: undertow, openEuler:22.03-LTS-SP3: undertow, openEuler:22.03-LTS-SP4: undertow, openEuler:24.03-LTS: undertow</p> <p>Java web server using non-blocking IO Security Fix(es):</p> <p>undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker to cause a MITM attack and access the desired content on the server.(CVE-2017-12196)</p> <p>undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.(CVE-2019-10184)</p> <p>A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user&amp;apos;s credentials from the log files.(CVE-2019-10212)</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: undertow, openEuler:20.03-LTS-SP4: undertow, openEuler:22.03-LTS-SP3: undertow, openEuler:22.03-LTS-SP4: undertow, openEuler:24.03-LTS: undertow</p> <p>Java web server using non-blocking IO Security Fix(es):</p> <p>undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker to cause a MITM attack and access the desired content on the server.(CVE-2017-12196)</p> <p>undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.(CVE-2019-10184)</p> <p>A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user&amp;apos;s credentials from the log files.(CVE-2019-10212)</p> https://cve.radiocsirt.org/vuln/oesa-2025-1257 https://cve.radiocsirt.org/vuln/rhsa-2018:0478 <p>resteasy: Vary header not added by CORS filter leading to cache poisoning artemis/hornetq: memory exhaustion via UDP and JGroups discovery undertow: Client can use bogus uri in Digest authentication infinispan: Unsafe deserialization of malicious object injected into data cache jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525) jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-15095) undertow: ALLOW_ENCODED_SLASH option not taken into account in the AjpRequestParser jackson-databind: unsafe deserialization due to incomplete blacklist (incomplete fix for CVE-2017-7525 and CVE-2017-17485)</p> <p>resteasy: Vary header not added by CORS filter leading to cache poisoning artemis/hornetq: memory exhaustion via UDP and JGroups discovery undertow: Client can use bogus uri in Digest authentication infinispan: Unsafe deserialization of malicious object injected into data cache jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525) jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-15095) undertow: ALLOW_ENCODED_SLASH option not taken into account in the AjpRequestParser jackson-databind: unsafe deserialization due to incomplete blacklist (incomplete fix for CVE-2017-7525 and CVE-2017-17485)</p> https://cve.radiocsirt.org/vuln/rhsa-2018:0478 https://cve.radiocsirt.org/vuln/ubuntu-cve-2017-12196 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: undertow, Ubuntu:Pro:18.04:LTS: undertow, Ubuntu:Pro:24.04:LTS: undertow</p> <p>undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker to cause a MITM attack and access the desired content on the server.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: undertow, Ubuntu:Pro:18.04:LTS: undertow, Ubuntu:Pro:24.04:LTS: undertow</p> <p>undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker to cause a MITM attack and access the desired content on the server.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2017-12196 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2753 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat JBoss Enterprise Application Platform ausnutzen, um einen Denial of Service Angriff durchzuführen, Daten offenzulegen, Sicherheitsrestriktionen zu umgehen oder Code zur Ausführung zu bringen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat JBoss Enterprise Application Platform ausnutzen, um einen Denial of Service Angriff durchzuführen, Daten offenzulegen, Sicherheitsrestriktionen zu umgehen oder Code zur Ausführung zu bringen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2753