Red Hat Undertow vulnerabilities

39 CVEs affecting Red Hat Undertow, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-28369, published 2026-03-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-7816, published 2014-12-01. Medium severity, CVSS 5.0. EPSS: 25.1% chance of exploitation in the next 30 days. Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x before 1.1.0.CR5, and 1.2.x before 1.2.0.Beta3, when running on Windows, allows remote attackers to read arbitrary files…
CVE-2020-1745, published 2020-04-28. Critical severity, CVSS 9.8. EPSS: 5% chance of exploitation in the next 30 days. A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before and was fixed in 2.0.30.Final. A…
CVE-2017-2670, published 2018-07-27. High severity, CVSS 7.5. EPSS: 3.6% chance of exploitation in the next 30 days. It was found in Undertow before 1.3.28 that with non-clean TCP close, the Websocket server gets into infinite loop on every IO thread, effectively causing DoS.
CVE-2019-10184, published 2019-07-25. High severity, CVSS 7.5. EPSS: 3.5% chance of exploitation in the next 30 days. undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.
CVE-2017-2666, published 2018-07-27. Medium severity, CVSS 6.5. EPSS: 3.1% chance of exploitation in the next 30 days. It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid…
CVE-2019-3888, published 2019-06-12. Critical severity, CVSS 9.8. EPSS: 3% chance of exploitation in the next 30 days. A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the…
CVE-2023-3223, published 2023-09-27. High severity, CVSS 7.5. EPSS: 2.7% chance of exploitation in the next 30 days. A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of…
CVE-2018-1114, published 2018-09-11. Medium severity, CVSS 6.5. EPSS: 2.3% chance of exploitation in the next 30 days. It was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized which can cause file descriptors to exhaust. This leads to a file handler leak.
CVE-2025-9784, published 2025-09-02. High severity, CVSS 7.5. EPSS: 2.3% chance of exploitation in the next 30 days. A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows…
CVE-2019-14888, published 2020-01-23. High severity, CVSS 7.5. EPSS: 2.2% chance of exploitation in the next 30 days. A vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS. An attacker can target the HTTPS port to carry out a Denial Of Service (DOS) to make the…

Latest

CVE-2026-28369, published 2026-03-27. Critical severity, CVSS 9.1. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly processes the request by stripping these leading…
CVE-2026-28368, published 2026-03-27. Critical severity, CVSS 9.1. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies.…
CVE-2026-28367, published 2026-03-27. Critical severity, CVSS 9.1. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator. This can be used for request smuggling with certain proxy servers,…
CVE-2025-12543, published 2026-01-07. Critical severity, CVSS 9.6. EPSS: 1.3% chance of exploitation in the next 30 days. A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP…
CVE-2024-1459, published 2024-02-12. Medium severity, CVSS 5.3. EPSS: 1.7% chance of exploitation in the next 30 days. A path traversal vulnerability was found in Undertow. This issue may allow a remote attacker to append a specially-crafted sequence to an HTTP request for an application deployed to JBoss EAP, which…
CVE-2023-5379, published 2023-12-12. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. A flaw was found in Undertow. When an AJP request is sent that exceeds the max-header-size attribute in ajp-listener, JBoss EAP is marked in an error state by mod_cluster in httpd, causing JBoss EAP…
CVE-2023-1108, published 2023-09-14. High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days. A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates.
CVE-2022-4492, published 2023-02-23. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and…