CLSA-2026-1786429714 TuxCare security update for io.undertow (3 CVEs)

🗓️ 11 Aug 2026 06:28:34Reported by GoogleType

osv🔗 osv.dev👁 4 Views

TuxCare security update for io.undertow addresses 1 CVE in version 2.3.17.Final-tuxcare.1.

Reporter	Title	Published	Views	Family All 174
IBM Security Bulletins	Security Bulletin: DevOps Test Performance contains a vulnerability related to use of the Undertow web server	10 Apr 202613:38	–	ibm
IBM Security Bulletins	Security Bulletin: DevOps Test Performance contains a vulnerability related to use of the Undertow web server component	10 Apr 202614:14	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Terracotta is affected by two Undertow vulnerabilities that could allow remote denial of service attacks and Host header manipulation leading to cache poisoning or session hijacking	23 Feb 202619:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Undertow	24 Mar 202619:29	–	ibm
IBM Security Bulletins	Security Bulletin: Improper Host Header Validation in Undertow HTTP Server Enables Cache Poisoning and Session Hijacking affects watsonx.data	9 Apr 202616:52	–	ibm
IBM Security Bulletins	Security Bulletin: DevOps Test Performance contains a vulnerability related to use of the Undertow server core	10 Apr 202614:17	–	ibm
ATTACKERKB	CVE-2024-3884	3 Dec 202518:40	–	attackerkb
ATTACKERKB	CVE-2025-12543	7 Jan 202616:04	–	attackerkb
BDU FSTEC	The vulnerability of the Undertow HTTP server’s kernel allows for attacks using SSRF, due to errors in the mechanism for processing input data when handling Host headers.	9 Jan 202600:00	–	bdu_fstec
Broadcom	Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf (CVE-2025-12543)	26 Jan 202600:00	–	broadcom

11 Sep 2026 13:57Current

5.3Medium risk

Vulners AI Score5.3

CVSS 3.19.6

EPSS0.01359

SSVC

io.undertow security update tuxcare CVE package rebuild