1686 matches found
CVE-2026-28368 Undertow: undertow: request smuggling via inconsistent header parsing
A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be exploited to launch request smuggling attacks,...
CVE-2026-28368 Undertow: undertow: request smuggling via inconsistent header parsing
A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be exploited to launch request smuggling attacks,...
Undertow 环境问题漏洞
Undertow is a web server provided by the Undertow company in the United States. Undertow has an environmental issue vulnerability, which stems from the ability of remote attackers to send specific header block terminators, potentially leading to request payload attacks...
PT-2026-28378
Name of the Vulnerable Software and Affected Versions Undertow affected versions not specified Description A flaw exists in Undertow where the software incorrectly processes HTTP requests containing leading spaces in the first header line, violating HTTP standards. This can be exploited to perfor...
PT-2026-28376
Name of the Vulnerable Software and Affected Versions Undertow affected versions not specified Description A flaw exists in Undertow that allows a remote attacker to exploit the software by sending rrr as a header block terminator. This can be used for request smuggling with certain proxy servers...
Undertow 环境问题漏洞
Undertow is a web server provided by the Undertow company in the United States. Undertow has a security vulnerability that stems from its failure to follow standards when processing HTTP request headers starting with spaces. This vulnerability may allow remote attackers to execute request payload...
Undertow 环境问题漏洞
Undertow is a web server provided by the Undertow company in the United States. Undertow has an environmental issue vulnerability, which stems from the ability of remote attackers to construct specially crafted requests that lead to header parsing discrepancies, potentially allowing for request...
PT-2026-28377
Name of the Vulnerable Software and Affected Versions Undertow affected versions not specified Description A security issue exists in Undertow that allows a remote attacker to create malicious requests. The issue stems from discrepancies in how Undertow parses header names compared to upstream...
Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Undertow
Summary Multiple vulnerabilities in Undertow that is used by InfoSphere Information Server were addressed. Vulnerability Details CVEID:CVE-2024-3884 DESCRIPTION: A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the...
EUVD-2026-14732
A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending an HTTP GET request containing multipart/form-data content. If the underlying application processes parameters using methods like getParameterMap, the server prematurely parses and stores this content to...
Allocation of Resources Without Limits or Throttling
Overview io.undertow:undertow-core is a Java web server based on non-blocking IO. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the MultiPartParserDefinition multipart parsing process in MultiPartParserDefinition.java. An attacker can...
Undertow: Denial of Service via Multipart/Form-Data Parsing on HTTP GET Requests
A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending an HTTP GET request containing multipart/form-data content. If the underlying application processes parameters using methods like getParameterMap, the server prematurely parses and stores this content to...
GHSA-3X3V-W654-M28M Undertow: Denial of Service via Multipart/Form-Data Parsing on HTTP GET Requests
A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending an HTTP GET request containing multipart/form-data content. If the underlying application processes parameters using methods like getParameterMap, the server prematurely parses and stores this content to...
CVE-2026-3260
Rejected reason: The Undertow web server enforces a default maximum HTTP request entity size limit. Any request including GET or HEAD containing a body that exceeds this configurable limit is safely dropped by the server, preventing single-request Resource Exhaustion Out of Memory Denial of Servi...
DEBIAN-CVE-2026-3260
Bulletin has no description...
CVE-2026-3260
Rejected reason: The Undertow web server enforces a default maximum HTTP request entity size limit. Any request including GET or HEAD containing a body that exceeds this configurable limit is safely dropped by the server, preventing single-request Resource Exhaustion Out of Memory Denial of Servi...
UBUNTU-CVE-2026-3260
A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending an HTTP GET request containing multipart/form-data content. If the underlying application processes parameters using methods like getParameterMap, the server prematurely parses and stores this content to...
CVE-2026-3260
Removed by vendor...
CVE-2026-3260
Undertow-based products are affected by CVE-2026-3260. A flaw allows remote attackers to trigger Denial of Service by sending an HTTP GET request containing multipart/form-data; if applications parse parameters with getParameterMap(), Undertow may prematurely parse and store content to disk, cons...