CVE-2026-49365

CVE-2026-49365 — camel-netty-http / camel-undertow muteException スタックトレースの開示 同じApache Camel脆弱性に対する実行可能な概念実証再現コードで、ランタイムごとに1つずつ用意されています： ランタイム| ディレクトリ| スタック| 表示されるコンポーネント ---|---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 + camel-spring-boot 4.18.2| netty-http および undertow...

CVE-2025-9784

CVE-2025-9784 MadeYouReset HTTP/2 脆弱性テスト 概要 このリポジトリには、Undertow HTTP/2 サーバー実装における CVE-2025-9784 脆弱性（「MadeYouReset」HTTP/2 サービス拒否（DoS）攻撃として知られる）をテストするための、シンプルかつ効果的な bash スクリプトが含まれています。この脆弱性により、攻撃者はサーバー側のストリームリセットを繰り返し発生させてサーバーに過剰な負荷を誘発し、サービス障害を引き起こす可能性があります。 機能 対象サーバーが HTTP/2 プロトコルをサポートしているかどうかを検出しま...

CVE-2026-21876

CVE-2026-21876 OWASP CRS WAFバイパス CVE-2026-21876 Dockerコンテナ + 最小限のPoC。 迅速な対応をいただいた @airween と @fzipi に個別に感謝します！脆弱性の修正は非常に短時間で準備されました。 PoC 実行: cd springbootundertowstand or aspnetstand docker compose up --build python3 demo/send.py BASELINE - 403, BYPASS - 200 + reconstructed payload 参考文献...

CVE-2025-12543-Fix-for-Wildfly

WildFly 11.0.0.Final ベースイメージ — CVE-2025-12543 パッチ 概要 このリポジトリは、WildFly 11.0.0.Final 上に構築された Docker ベースイメージを提供し、Undertow における深刻な Host ヘッダ検証の脆弱性 CVE-2025-12543 に対するバックポート修正を含んでいます。 このイメージは、同僚にベースとして提供することを意図しています。各自の .war アプリケーションや standalone.xml をその上にデプロイできます。 CVE-2025-12543 の概要 項目| 詳細 ---|--- CVE...

CVE-2026-78329

CVE-2026-78329 — camel-undertow のヘッダーフィルター戦略が適用されない websocket. インジェクション Apache Camel の脆弱性に対する実行可能な PoC 再現コードです。UndertowEndpoint はデフォルトで headerFilterStrategy を基底の HttpHeaderFilterStrategy に設定し、そのインスタンスを自身が作成する UndertowHttpBinding に渡すため、DefaultUndertowHttpBinding がインストールする...

CVE-2026-56139

camel-undertow Rest DSL muteException スタックトレース開示再現器 CVE-2026-56139 このプロジェクトは、Apache Camel の camel-undertow Rest DSL コンシューマにおける 情報漏洩 の問題を示しています。追跡番号は CVE-2026-56139 です。muteException オプションは、キャッチされなかった処理例外の詳細を HTTP クライアントに返すかどうかを制御します。プレーンな undertow エンドポイントではこのオプションは機能しますが、undertow Rest DSL は...

undertow-io__undertow_CVE-2014-7816_1-0-16-Final

Undertow Undertow は、ノンブロッキング IO をベースとした Java Web サーバーです。いくつかの異なる部分から構成されています: ブロッキング IO とノンブロッキング IO の両方をサポートするコア HTTP サーバー Servlet 3.1 実装 JSR-356 準拠の WebSocket 実装 Webサイト: http://undertow.io 課題: https://issues.jboss.org/browse/UNDERTOW プロジェクトリーダー: Stuart Douglas [email protected] メーリングリスト:...

artemis-server: artemis-jms-client: artemis-core-client: undertow-core: wildfly-messaging-activemq-subsystem: artemis messaging handlers in Red Hat EAP permit deserialization by default

EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity/isTrustedType method. However, by default both allow-list and block-list are empty...

undertow-core: Undertow: Authentication Bypass via AJP ssl_cert/is_ssl Forgery

the Undertow AJP listener honours forged sslcert and isssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP...

undertow-core: Undertow: Denial of Service via WebSocket permessage-deflate processing

A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket messages with permessage-deflate negotiated. This could lead to excessive memory consumption due to the PerMessageDeflateFunction.largerBuffer method using exponential doubling,...

undertow: undertow-websockets: Undertow: Pre-Auth DoS on websocket endpoint with @ServerEndpoint class with any @OnMessage method

A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket...

undertow-core: OOM via missing limits in chunked trailer in EAP's Undertow

A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service...

artemis-server: undertow-core: wildfly-messaging-activemq-subsystem: artemis core protocol permits unauthed queue creation

Artemis CORE protocol channel allows unauthed queue creation. an unauthenticated attacker can send CREATEQUEUE packets on channel 1 via the :8080 HTTP-upgrade path to create arbitrary durable JMS queues on the embedded broker. This can be used for resource exhaustion and persistent broker-state...

undertow-core: Undertow:HTTP request smuggling via oversized chunk-size bit overlap

A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially...

undertow-core: Undertow: Authentication Bypass via AJP ssl_cert/is_ssl Forgery

the Undertow AJP listener honours forged sslcert and isssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP...

undertow-core: Undertow:HTTP request smuggling via oversized chunk-size bit overlap

A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially...

undertow: undertow-websockets: Undertow: Pre-Auth DoS on websocket endpoint with @ServerEndpoint class with any @OnMessage method

A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket...

undertow-core: Undertow: Denial of Service via WebSocket permessage-deflate processing

A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket messages with permessage-deflate negotiated. This could lead to excessive memory consumption due to the PerMessageDeflateFunction.largerBuffer method using exponential doubling,...

undertow-core: OOM via missing limits in chunked trailer in EAP's Undertow

A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service...

undertow-core: Undertow: Authentication Bypass via AJP ssl_cert/is_ssl Forgery

the Undertow AJP listener honours forged sslcert and isssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP...