Malicious code in undertow-honeycomb-peb878-project (npm)

The package undertow-honeycomb-peb878-project was found to contain malicious code...

Malicious code in ember_l12uw_mtim5_undertow (npm)

The package emberl12uwmtim5undertow was found to contain malicious code...

Malicious code in hill-undertow-dhf073-project (npm)

The package hill-undertow-dhf073-project was found to contain malicious code...

Malicious code in undertow-umbrella-scu465-project (npm)

The package undertow-umbrella-scu465-project was found to contain malicious code...

MAL-2025-20840 Malicious code in fox-undertow-wmc930-project (npm)

The package fox-undertow-wmc930-project was found to contain malicious code...

Malicious code in undertow-falcon-dbg379-project (npm)

The package undertow-falcon-dbg379-project was found to contain malicious code...

MAL-2025-37724 Malicious code in undertow-honeycomb-peb878-project (npm)

The package undertow-honeycomb-peb878-project was found to contain malicious code...

MAL-2025-40125 Malicious code in yak-undertow-pzf309-project (npm)

The package yak-undertow-pzf309-project was found to contain malicious code...

MAL-2025-37725 Malicious code in undertow-mangrove-sye608-project (npm)

The package undertow-mangrove-sye608-project was found to contain malicious code...

undertow: special character in query results in server errors

A flaw was found in the Undertow AJP connector. Malicious requests and abrupt connection closes could be triggered by an attacker using query strings with non-RFC compliant characters resulting in a denial of service. The highest threat from this vulnerability is to system availability...

undertow: AJP Request closes connection exceeding maxRequestSize

A flaw was found in Undertow. When an AJP request is sent that exceeds the max-header-size attribute in ajp-listener, JBoss EAP is marked in an error state by modcluster in httpd, causing JBoss EAP to close the TCP connection without returning an AJP response. This happens because modproxycluster...

undertow: potential security issue in flow control over HTTP/2 may lead to DOS(incomplete fix for CVE-2021-3629)

A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server...

undertow: Server identity in https connection is not checked by the undertow client

A flaw was found in undertow. The undertow client is not checking the server identity the server certificate presents in HTTPS connections. This is a compulsory step that should at least be performed by default in HTTPS and in http/2...

undertow: Large AJP request may cause DoS

A flaw was found in Undertow. AJP requests to the server may allow an attacker to send a malicious request and trigger server errors, resulting in a denial of service...

undertow: unrestricted request storage leads to memory exhaustion

A flaw was found in Undertow package. Using the FormAuthenticationMechanism, a malicious user could trigger a Denial of Service by sending crafted requests, leading the server to an OutofMemory error, exhausting the server's memory...

undertow: Out-of-memory Error after several closed connections with wildfly-http-client protocol

A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and closes a connection with the HTTP port of the server and then closes the connection immediately, the server will end with both memory and...

undertow: potential security issue in flow control over HTTP/2 may lead to DOS(incomplete fix for CVE-2021-3629)

A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server...

undertow: Server identity in https connection is not checked by the undertow client

A flaw was found in undertow. The undertow client is not checking the server identity the server certificate presents in HTTPS connections. This is a compulsory step that should at least be performed by default in HTTPS and in http/2...

undertow: Double AJP response for 400 from EAP 7 results in CPING failures

A flaw was found in Undertow. For an AJP 400 response, EAP 7 is improperly sending two response packets, and those packets have the reuse flag set even though JBoss EAP closes the connection. A failure occurs when the connection is reused after a 400 by CPING since it reads in the second...

Undertow: Infinite loop in SslConduit during close

A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates...