Red Hat undertow vulnerabilities

39 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 5 published in the last 12 months.

Latest Red Hat undertow vulnerabilities

CVE-2026-28369 — Undertow: undertow: request smuggling via malformed http request headers (CVSS 9.1)
CVE-2026-28368 — Undertow: undertow: request smuggling via inconsistent header parsing (CVSS 9.1)
CVE-2026-28367 — Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator (CVSS 9.1)
CVE-2025-12543 — Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf (CVSS 9.6)
CVE-2025-9784 — Undertow: undertow madeyoureset http/2 ddos vulnerability (CVSS 7.5)
CVE-2024-1459 — Undertow: directory traversal vulnerability (CVSS 5.3)
CVE-2023-5379 — Undertow: ajp request closes connection exceeding maxrequestsize (CVSS 7.5)
CVE-2023-3223 — Undertow: outofmemoryerror due to @multipartconfig handling (CVSS 7.5)
CVE-2023-1108 — Undertow: infinite loop in sslconduit during close (CVSS 7.5)
CVE-2022-4492 — (CVSS 7.5)
CVE-2022-2764 — (CVSS 4.9)
CVE-2022-1319 — (CVSS 7.5)
CVE-2022-1259 — (CVSS 7.5)
CVE-2021-3859 — (CVSS 7.5)
CVE-2021-3690 — (CVSS 7.5)
CVE-2022-2053 — (CVSS 7.5)
CVE-2021-3629 — (CVSS 5.9)
CVE-2021-3597 — (CVSS 5.9)
CVE-2019-19343 — (CVSS 7.5)
CVE-2020-27782 — (CVSS 7.5)
CVE-2021-20220 — (CVSS 4.8)
CVE-2020-10687 — (CVSS 4.8)
CVE-2020-10705 — (CVSS 7.5)
CVE-2020-10719 — (CVSS 6.5)
CVE-2020-1745 — (CVSS 9.8)