undertow: Long URL proxy request lead to java.nio.BufferOverflowException and DoS

It was discovered that a long URL sent to EAP 7 Server operating as a reverse proxy with default buffer sizes causes a Denial of Service...

undertow: IO thread DoS via unclean Websocket closing

It was found that with non-clean TCP close, Websocket server gets into infinite loop on every IO thread, effectively causing DoS...

Red Hat Undertow Remote Denial of Service Vulnerability (CNVD-2017-17195)

Red Hat Undertow is a web server from Red Hat USA. A remote denial of service vulnerability exists in Red Hat Undertow. A remote attacker could exploit this vulnerability to cause a denial of service infinite loop...

Red Hat WildFly Undertow Module Source Code Disclosure Vulnerability

Red Hat Wildfly formerly known as JBoss Application Server is the United States Red Hat Red Hat a JavaEE-based open source application server. Undertow module is one of the Web server components. A security vulnerability exists in the Undertow module in Red Hat WildFly versions 9.0.0.CR2 prior to...

Code injection

The Undertow module of WildFly 9.x before 9.0.0.CR2 and 10.x before 10.0.0.Alpha1 allows remote attackers to obtain the source code of a JSP page via a "/" at the end of a URL...

CVE-2015-3198

The Undertow module of WildFly 9.x before 9.0.0.CR2 and 10.x before 10.0.0.Alpha1 allows remote attackers to obtain the source code of a JSP page via a "/" at the end of a URL...

CVE-2015-3198

The Undertow module of WildFly 9.x before 9.0.0.CR2 and 10.x before 10.0.0.Alpha1 allows remote attackers to obtain the source code of a JSP page via a "/" at the end of a URL...

CVE-2015-3198

The vulnerability CVE-2015-3198 affects the Undertow module of WildFly 9.x (before 9.0.0.CR2) and 10.x (before 10.0.0.Alpha1). It allows remote attackers to disclose JSP source code by requesting a URL ending with a trailing slash, exposing JSP source to partial confidentiality impact. The issue’...

Debian DSA-3906-1 : undertow - security update

Two vulnerabilities have been discovered in Undertow, a web server written in Java, which may lead to denial of service or HTTP request smuggling. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Adviso...

[SECURITY] [DSA 3906-1] undertow security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3906-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 11, 2017 https://www.debian.org/security/faq -...

DSA-3906-1 undertow - security update

Bulletin has no description...

Debian Security Advisory DSA 3906-1 (undertow - security update)

Two vulnerabilities have been discovered in Undertow, a web server written in Java, which may lead to denial of service or HTTP request smuggling. OpenVAS Vulnerability Test $Id: deb3906.nasl 6716 2017-07-13 11:39:30Z cfischer $ Auto-generated from advisory DSA 3906-1 using nvtgen 1.0 Script...

Debian: Security Advisory (DSA-3906-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Denial Of Service (DoS)

Undertow is vulnerable to denial of service DoS attacks. The library does not close its streaming websocket properly, leading to an infinite loop. A malicious user can use this behavior to cause multiple infinite loops that lead to the system running out of resources and crashing...

HTTP Smuggling

undertow is vulnerable to HTTP Smuggling attacks. The library does not verify that messages do not contain invalid headers, allowing a malicious user to conduct http smuggling that can lead to cross-site scripting attacks. This is related to an incomplete fix in CVE-2017-2666...

Red Hat Undertow Security Bypass Vulnerability

Red Hat Undertow is a web server from Red Hat USA. A security bypass vulnerability exists in Red Hat Undertow. An attacker could exploit this vulnerability to bypass security restrictions and perform unauthorized operations...

undertow: IO thread DoS via unclean Websocket closing

It was found that with non-clean TCP close, Websocket server gets into infinite loop on every IO thread, effectively causing DoS...

undertow: HTTP Request smuggling vulnerability due to permitting invalid characters in HTTP requests

It was discovered that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP...

undertow: IO thread DoS via unclean Websocket closing

It was found that with non-clean TCP close, Websocket server gets into infinite loop on every IO thread, effectively causing DoS...

undertow: HTTP Request smuggling vulnerability due to permitting invalid characters in HTTP requests

It was discovered that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP...