Approved changes feed: RSS · Atom
cpe:2.3:a:red_hat:undertow:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Red Hat (a3686528-5679-55c9-b393-abe45df26bd2) |
|---|---|
| Product | Undertow (d07ee26a-ccca-5fb0-9489-fbd012d77a74) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2020-1757 |
vulnerable | 2026-06-08 05:21:02.978873 |
Details available
HIGH (8.1)
A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final, where the Servlet container causes servletPath to normalize incorrectly by truncating the path after semicolon which may lead to an application mapping resulting in the security bypass.
Published: 2020-04-21T15:31:14.000Z
Updated: 2024-08-04T06:46:30.881Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-10719 |
vulnerable | 2026-06-08 05:16:35.729259 |
Details available
MEDIUM (6.5)
A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes. This flaw allows an attacker to take advantage of HTTP request smuggling.
Published: 2020-05-26T14:57:51.000Z
Updated: 2024-08-04T11:14:14.887Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-3888 |
vulnerable | 2026-06-08 05:13:56.307776 |
Details available
MEDIUM (5.3)
A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUEST_LOGGER.undertowRequestFailed(t, exchange)
Published: 2019-06-12T13:45:20.000Z
Updated: 2024-08-04T19:19:18.684Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-14888 |
vulnerable | 2026-06-08 05:12:56.348734 |
Details available
HIGH (7.5)
A vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS. An attacker can target the HTTPS port to carry out a Denial Of Service (DOS) to make the service unavailable on SSL.
Published: 2020-01-23T16:25:11.000Z
Updated: 2024-08-05T00:26:39.131Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-1114 |
vulnerable | 2026-06-08 05:11:16.940850 |
Details available
MEDIUM (6.5)
It was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized which can cause file descriptors to exhaust. This leads to a file handler leak.
Published: 2018-09-11T15:00:00.000Z
Updated: 2024-08-05T03:51:48.638Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-14642 |
vulnerable | 2026-06-08 05:10:53.186792 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-12165 |
vulnerable | 2026-06-08 05:08:45.427784 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.