Vulmon Recent Vulnerabilities Product List Research Posts Trends Blog About Contact

redhat undertow vulnerabilities and exploits

(subscribe to this query)
2.6
CVSSv2

CVE-2021-3597

A flaw was found in undertow. The HTTP2SourceChannel fails to write the final frame under some circumstances, resulting in a denial of service. The highest threat from this vulnerability is availability. This flaw affects Undertow versions before 2.0.35.SP1, before 2.2.6.SP1, bef...
Redhat Fuse 1.0Redhat Jboss Enterprise Application Platform -Redhat Openshift Application Runtimes -Redhat Single Sign-on -Redhat UndertowRedhat Undertow 2.0.35Redhat Undertow 2.0.36Redhat Undertow 2.0.39Redhat Undertow 2.2.6Redhat Undertow 2.2.7Redhat Undertow 2.2.9Redhat Jboss Enterprise Application Platform 7.3
5.5
CVSSv2

CVE-2020-1757

A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final, where the Servlet container causes servletPath to normalize incorrectly by truncating the path after semicolon which may...
Redhat UndertowRedhat Undertow 2.0.0Redhat Undertow 2.0.25Redhat Undertow 2.0.26Redhat Undertow 2.0.28Redhat Jboss Data Grid 7.0.0Redhat Jboss Enterprise Application Platform 7.0.0Redhat Jboss Fuse 6.0.0Redhat Jboss Fuse 7.0.0Redhat Openshift Application Runtimes -Redhat Single Sign-on 7.0
7.8
CVSSv2

CVE-2020-27782

A flaw was found in the Undertow AJP connector. Malicious requests and abrupt connection closes could be triggered by an attacker using query strings with non-RFC compliant characters resulting in a denial of service. The highest threat from this vulnerability is to system availa...
Redhat Jboss Fuse 6.0.0Redhat Jboss Fuse 7.0.0Redhat Openshift Application Runtimes -Redhat Undertow 2.0.33Redhat Undertow 2.1.5Redhat Undertow 2.2.3
7.5
CVSSv3

CVE-2022-2053

When a POST request comes through AJP and the request exceeds the max-post-size limit (maxEntitySize), Undertow's AjpServerRequestConduit implementation closes a connection without sending any response to the client/proxy. This behavior results in that a front-end proxy mark...
Redhat Integration Camel K -Redhat Jboss Fuse 7.0.0Redhat UndertowRedhat Undertow 2.3.0
7.5
CVSSv3

CVE-2022-1319

A flaw was found in Undertow. For an AJP 400 response, EAP 7 is improperly sending two response packets, and those packets have the reuse flag set even though JBoss EAP closes the connection. A failure occurs when the connection is reused after a 400 by CPING since it reads in th...
Redhat Openshift Application Runtimes -Redhat Single Sign-on 7.0Redhat UndertowRedhat Undertow 2.2.17Redhat Undertow 2.2.19Redhat Undertow 2.3.0Netapp Active Iq Unified Manager -Netapp Cloud Secure Agent -Netapp Oncommand Insight -Netapp Oncommand Workflow Automation -
5
CVSSv2

CVE-2014-7816

Directory traversal vulnerability in JBoss Undertow 1.0.x prior to 1.0.17, 1.1.x prior to 1.1.0.CR5, and 1.2.x prior to 1.2.0.Beta3, when running on Windows, allows remote malicious users to read arbitrary files via a .. (dot dot) in a resource URI.
Redhat Undertow
5.3
CVSSv3

CVE-2024-1459

A path traversal vulnerability was found in Undertow. This issue may allow a remote malicious user to append a specially-crafted sequence to an HTTP request for an application deployed to JBoss EAP, which may permit access to privileged or restricted files and directories.
Redhat Undertow -
7.5
CVSSv2

CVE-2020-1745

A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before and was fixed in 2.0.30.Final. A remote, unauthenticated attacker could exploit this vulnerability to read web applicati...
Redhat Undertow
5
CVSSv2

CVE-2019-19343

A flaw was found in Undertow when using Remoting as shipped in Red Hat Jboss EAP before version 7.2.4. A memory leak in HttpOpenListener due to holding remote connections indefinitely may lead to denial of service. Versions before undertow 2.0.25.SP1 and jboss-remoting 5.0.14.SP1...
Redhat Jboss-remotingRedhat Jboss-remoting 5.0.14Redhat Jboss Enterprise Application PlatformRedhat UndertowRedhat Undertow 2.0.25Netapp Active Iq Unified Manager -
7.5
CVSSv3

CVE-2022-1259

A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server. This flaw exists because of an incomplete fix for CVE-2021-3629.
Redhat Build Of Quarkus -Redhat Integration Camel K -Redhat Jboss Enterprise Application Platform 7.0.0Redhat Openshift Application Runtimes -Redhat Single Sign-on 7.0Redhat UndertowRedhat Undertow 2.2.18Redhat Undertow 2.2.19Netapp Active Iq Unified Manager -Netapp Cloud Secure Agent -Netapp Oncommand Insight -Netapp Oncommand Workflow Automation -
Preferred Score:
CVSSv2
CVSSv2
CVSSv3
CVSSv4
EPSS
VMScore
Recommendations:
unprivilegedprivilege escalationCVE-2024-57040morningCVE-2025-24801CVE-2025-24813CVE-2025-29930CVE-2024-10442smartosCVE-2025-0694cryptolibmbconnect24local users
Home
/
Search Results
Vulmon Logo Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook