Debian Undertow vulnerabilities

CVE-2020-1745 [HIGH] CVE-2020-1745: undertow - A file inclusion vulnerability was found in the AJP connector enabled with a def... A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before and was fixed in 2.0.30.Final. A remote, unauthenticated attacker could exploit this vulnerability to read web application files from a vulnerable server. In instances where the vulnerable server allows file u

CVE-2019-3888 [CRITICAL] CVE-2019-3888: undertow - A vulnerability was found in Undertow web server before 2.0.21. An information e... A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUEST_LOGGER.undertowRequestFailed(t, exchange) Scope: local forky: resolved (fixed in 2.0.23-1) sid: resolved (fixed

CVE-2019-10212 [CRITICAL] CVE-2019-10212: undertow - A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow... A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user's credentials from the log files. Scope: local forky: resolved (fixed in 2.0.27-1) sid: resolved (fixed in 2.0.27-1)

CVE-2023-4639 [HIGH] CVE-2023-4639: undertow - A flaw was found in Undertow, which incorrectly parses cookies with certain valu... A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data c

CVE-2025-9784 [HIGH] CVE-2025-9784: undertow - A flaw was found in Undertow where malformed client requests can trigger server-... A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakn

CVE-2020-1757 [HIGH] CVE-2020-1757: undertow - A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1... A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final, where the Servlet container causes servletPath to normalize incorrectly by truncating the path after semicolon which may lead to an application mapping resulting in the security bypass. Scope: local forky: res

CVE-2024-1635 [HIGH] CVE-2024-1635: undertow - A vulnerability was found in Undertow. This vulnerability impacts a server that ... A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and closes a connection with the HTTP port of the server and then closes the connection immediately, the server will end with both memory and open file limits exhausted at some point, depending on the amount of mem

CVE-2019-10184 [HIGH] CVE-2019-10184: undertow - undertow before version 2.0.23.Final is vulnerable to an information leak issue.... undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api. Scope: local forky: resolved (fixed in 2.0.23-1) sid: resolved (fixed in 2.0.23-1)

CVE-2024-7885 [HIGH] CVE-2024-7885: undertow - A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses... A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a result, different requests may share the same StringBuilder instance, potentially leading to information leakage

CVE-2024-5971 [HIGH] CVE-2024-5971: undertow - A vulnerability was found in Undertow, where the chunked response hangs after th... A vulnerability was found in Undertow, where the chunked response hangs after the body was flushed. The response headers and body were sent but the client would continue waiting as Undertow does not send the expected 0\r\n termination of the chunked response. This results in uncontrolled resource consumption, leaving the server side to a denial of service attack. Thi

CVE-2023-3223 [HIGH] CVE-2023-3223: undertow - A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause... A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit the file size, it's possible to bypass the limit by setting the file name in the request to null. Scope: loc

CVE-2024-6162 [HIGH] CVE-2024-6162: undertow - A vulnerability was found in Undertow, where URL-encoded request paths can be mi... A vulnerability was found in Undertow, where URL-encoded request paths can be mishandled during concurrent requests on the AJP listener. This issue arises because the same buffer is used to decode the paths for multiple requests simultaneously, leading to incorrect path information being processed. As a result, the server may attempt to access the wrong path, causing

CVE-2022-2053 [HIGH] CVE-2022-2053: undertow - When a POST request comes through AJP and the request exceeds the max-post-size ... When a POST request comes through AJP and the request exceeds the max-post-size limit (maxEntitySize), Undertow's AjpServerRequestConduit implementation closes a connection without sending any response to the client/proxy. This behavior results in that a front-end proxy marking the backend worker (application server) as an error state and not forward requests to the

CVE-2023-1108 [HIGH] CVE-2023-1108: undertow - A flaw was found in undertow. This issue makes achieving a denial of service pos... A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates. Scope: local forky: resolved (fixed in 2.3.8-2) sid: resolved (fixed in 2.3.8-2)

CVE-2023-1973 [HIGH] CVE-2023-1973: undertow - A flaw was found in Undertow package. Using the FormAuthenticationMechanism, a m... A flaw was found in Undertow package. Using the FormAuthenticationMechanism, a malicious user could trigger a Denial of Service by sending crafted requests, leading the server to an OutofMemory error, exhausting the server's memory. Scope: local forky: resolved (fixed in 2.3.18-1) sid: resolved (fixed in 2.3.18-1)

CVE-2023-5379 [HIGH] CVE-2023-5379: undertow - A flaw was found in Undertow. When an AJP request is sent that exceeds the max-h... A flaw was found in Undertow. When an AJP request is sent that exceeds the max-header-size attribute in ajp-listener, JBoss EAP is marked in an error state by mod_cluster in httpd, causing JBoss EAP to close the TCP connection without returning an AJP response. This happens because mod_proxy_cluster marks the JBoss EAP instance as an error worker when the TCP connect

CVE-2018-1048 [HIGH] CVE-2018-1048: undertow - It was found that the AJP connector in undertow, as shipped in Jboss EAP 7.1.0.G... It was found that the AJP connector in undertow, as shipped in Jboss EAP 7.1.0.GA, does not use the ALLOW_ENCODED_SLASH option and thus allow the the slash / anti-slash characters encoded in the url which may lead to path traversal and result in the information disclosure of arbitrary local files. Scope: local forky: resolved (fixed in 1.4.22-1) sid: resolved (fixed

CVE-2020-27782 [HIGH] CVE-2020-27782: undertow - A flaw was found in the Undertow AJP connector. Malicious requests and abrupt co... A flaw was found in the Undertow AJP connector. Malicious requests and abrupt connection closes could be triggered by an attacker using query strings with non-RFC compliant characters resulting in a denial of service. The highest threat from this vulnerability is to system availability. This affects Undertow 2.1.5.SP1, 2.0.33.SP2, and 2.2.3.SP1. Scope: local forky:

CVE-2017-2670 [HIGH] CVE-2017-2670: undertow - It was found in Undertow before 1.3.28 that with non-clean TCP close, the Websoc... It was found in Undertow before 1.3.28 that with non-clean TCP close, the Websocket server gets into infinite loop on every IO thread, effectively causing DoS. Scope: local forky: resolved (fixed in 1.4.18-1) sid: resolved (fixed in 1.4.18-1)

CVE-2019-14888 [HIGH] CVE-2019-14888: undertow - A vulnerability was found in the Undertow HTTP server in versions before 2.0.28.... A vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS. An attacker can target the HTTPS port to carry out a Denial Of Service (DOS) to make the service unavailable on SSL. Scope: local forky: resolved (fixed in 2.0.30-1) sid: resolved (fixed in 2.0.30-1)