Red Hat Integration Camel K

A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a result, different requests may share the same StringBuilder instance, potentially leading to information leakage between requests or responses. In some cases, a value from a previous request or response may be erroneously reused, which could lead to unintended data exposure. This issue primarily results in errors and connection termination but creates a risk of data leakage in multi-request environments.

Published: 2024-08-21T14:13:36.579Z
Updated: 2026-01-19T03:51:37.166Z

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Published: 2023-10-10T00:00:00.000Z
Updated: 2026-07-14T12:03:17.389Z

A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates.

Published: 2023-09-14T14:48:58.869Z
Updated: 2024-08-02T05:32:46.370Z

The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and in http/2. I would add it to any TLS client protocol.

Published: 2023-02-23T00:00:00.000Z
Updated: 2025-03-12T14:34:50.123Z

In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. In certain conditions a server can cause a libpq client to over-read and report an error message containing uninitialized bytes.

Published: 2023-03-03T00:00:00.000Z
Updated: 2025-03-07T16:03:01.364Z