CVE-2023-1108

CVE-2023-1108 affects Undertow within Red Hat JBoss EAP 7.3.x (SSLConduit) where an infinite loop on close can cause DoS. Connected RHSA-2025-9583 confirms the issue and indicates a fix in the eap-7.3.z line (Patched Undertow). Remediation is to upgrade to the patched EAP 7.3.x release (eap-7.3.z...

CVE-2021-4104

CVE-2021-4104 affects JMSAppender in Log4j 1.2 when it is explicitly configured to use JMSAppender. A deserialization of untrusted data can occur if an attacker can write Log4j configuration and supply TopicBindingName and TopicConnectionFactoryBindingName, causing JMSAppender to perform JNDI req...

CVE-2019-3888

CVE-2019-3888 describes an information exposure in Undertow prior to 2.0.21 where Connectors.executeRootHandler logs the HttpServerExchange object at ERROR level via UndertowLogger.REQUEST_LOGGER.undertowRequestFailed, potentially exposing plain text credentials in log files. Connected documents ...

CVE-2019-10184

Undertow (the web server component referenced for CVE-2019-10184) is affected up to version 2.0.23.Final. The issue is an information exposure where web apps’ directory structures can be predicted through API requests made without trailing slashes, enabling partial confidentiality leakage. The li...

CVE-2021-3690

CVE-2021-3690 affects Undertow: a buffer leak on the incoming WebSocket PONG message can cause memory exhaustion leading to DoS. The vulnerability impacts Undertow-based components (WebSocket handling). A security update/patch for Undertow is available per OSV/OESA entries; exploit details are no...

CVE-2019-10219

The CVE-2019-10219 entry affects Hibernate Validator: SafeHtml validator annotation fails to sanitize HTML comments/instructions, enabling XSS in affected code paths. Affected CP4S versions are 1.7.2.0, 1.8.0.0, and 1.8.1.0. Remediation is to upgrade to Cloud Pak for Security 1.9.0.0 per IBM guid...

CVE-2021-3597

CVE-2021-3597 affects Undertow’s HTTP2SourceChannel and can cause DoS by failing to write the final frame. Affected products/versions include Undertow releases prior to 2.0.35.SP1, 2.2.6.SP1, 2.2.7.SP1, 2.0.36.SP1, 2.2.9.Final and 2.0.39.Final. The vulnerability is addressed in Red Hat JBoss EAP ...

CVE-2020-27782

The CVE-2020-27782 issue affects Undertow’s AJP connector. A flaw allows an attacker to trigger denial of service by sending malicious requests or causing abrupt connection closes when query strings use non-RFC compliant characters, potentially impacting availability. Affected versions are Undert...

CVE-2020-10719

Undertow under CVE-2020-10719 is vulnerable in versions before 2.1.1.Final due to improper handling of invalid HTTP requests with large chunk sizes, enabling HTTP request smuggling. Several connected sources (Red Hat advisories, Mageia security advisory) confirm a fix/update to Undertow 2.1.1.Fin...

CVE-2019-10212

CVE-2019-10212 affects Undertow (under 2.0.20) where DEBUG logging of io.undertow.request.security can leak user credentials from log files. Reported in multiple sources (including OSV entries and CNVD) as a log-file disclosure vulnerability with network-based access and high confidentiality/inte...

CVE-2022-1319

CVE-2022-1319 affects Undertow (via JBoss EAP 7) where an AJP 400 response can trigger two response packets that carry the reuse flag, and the connection reuse logic reads the second SEND_HEADERS instead of CPONG after a CPING. This can lead to a vulnerability in scenarios where connections are r...

CVE-2020-25644

CVE-2020-25644 is a memory‑leak vulnerability in WildFly OpenSSL (WildFly OpenSSL natives) prior to 1.1.3.Final. The flaw causes a memory leak per HTTP session creation, which can lead to Out-Of-Memory and a denial of service, predominantly affecting availability. Affected component/file: WildFly...

CVE-2021-3642

CVE-2021-3642 describes a timing-attack vulnerability in Wildfly Elytron’s ScramServer, affecting versions prior to 1.10.14.Final, 1.15.5.Final, and 1.16.1.Final. The highest impact is confidentiality; no exploitation details are provided in the documents. Connected advisories (e.g., Red Hat RHSA...

CVE-2021-4178

CVE-2021-4178 affects the Fabric8 Kubernetes client (versions 5.0.0-beta-1 and newer) due to unsafe YAML parsing in unmarshalYaml, enabling local, privileged code execution via a crafted YAML payload. The issue is confirmed across multiple sources (NVD/NVD-derived entry and Red Hat/Jenkins adviso...

CVE-2020-1757

The connected Red Hat advisory RHSA-2024:5856 confirms CVE-2020-1757 in Undertow: servletPath normalization could truncate a path after a semicolon, enabling dangerous application mapping and a security bypass. Affected products/versions include Undertow-based components within Red Hat JBoss EAP ...

CVE-2020-1714

Keycloak before 11.0.0 contains usages of ObjectInputStream without type checks, allowing deserialization of arbitrary Java objects in a privileged context and potentially enabling remote code execution (CVE-2020-1714). References associate this CVE with Red Hat advisories noting Keycloak as the ...

CVE-2020-14297

Technical details for CVE-2020-14297 are not publicly provided in the supplied connected documents. Monitor for updates.

CVE-2022-1259

CVE-2022-1259 is an Undertow-related denial-of-service issue. The root cause is an incomplete fix for CVE-2021-3629, causing potential DoS from HTTP/2 flow-control handling. Connected documents (Nessus plugin references and IBM/Red Hat advisories) confirm this in context of Undertow and note that...

CVE-2020-1710

CVE-2020-1710 concerns Undertow in Red Hat JBoss EAP/WildFly stack where the field-name is not parsed per RFC7230, causing a 200 instead of a 400. The CVE is referenced in Red Hat advisory RHSA-2024:5856 as part of security fixes for JBoss EAP 7.x on RHEL 7, indicating a remediation path within t...

CVE-2020-10688

CVE-2020-10688 affects RESTEasy prior to 3.11.1.Final and 4.5.3.Final, where improper URL encoding during RESTEASY003870 exception handling enables a reflected XSS attack. The issue resides in the RESTEasy component and enables an attacker to execute script in a victim’s browser when user-supplie...

CVE-2020-25689

CVE-2020-25689 : In WildFly, all versions up to 21.0.0.Final exhibit a memory-leak in the host-controller when reconnection attempts loop, causing new connections to be created but not properly closed. This can trigger an Out of Memory (OOM) condition and denial of service, primarily affecting av...

CVE-2020-10705

CVE-2020-10705 affects Undertow prior to 2.1.1.Final, where requests using the Expect: 100-continue header can trigger a memory exhaustion error, potentially causing a denial of service. The vulnerability is documented in the CVE page and appears in related advisories (e.g., Red Hat JBoss EAP 7.x...

CVE-2020-14307

CVE-2020-14307 affects WildFly’s EJB components shipped with Red Hat JBoss EAP 7. SessionOpenInvocations are not removed from the remote InvocationTracker after a response, on both client and server. This can cause a denial of service, making the service unavailable. The provided documents do not...

CVE-2019-10174

CVE-2019-10174 concerns Infinispan. The public ReflectionUtil.invokeAccessibly method allows an application class to invoke private methods in any class with Infinispan’s privileges, enabling unintended behavior changes via reflection. Connected advisories (OSV/RHSA) reference a security fix path...

CVE-2020-1718

CVE-2020-1718 affects Keycloak: a flaw in the reset credential flow in all Keycloak versions before 8.0.0 allows an attacker to gain unauthorized access to the application. This is corroborated by the GHSA entry describing the same issue. Exploitation status and remediation details are not provid...

CVE-2019-14887

CVE-2019-14887 affects WildFly when using the OpenSSL security provider: the configured enabled-protocols setting is not honored, allowing downgrading TLS for traffic and potentially leaking data. Affected WildFly releases include 7.2.0.GA, 7.2.3.GA, and 7.2.5.CR2. The issue is referenced in Red ...

CVE-2020-1724

CVE-2020-1724 – Keycloak privacy exposure before 9.0.2 : A flaw in Keycloak (versions before 9.0.2) allows a malicious user who is currently logged in to see the personal information of a previously logged-out user in the account manager section. The description and connected sources confirm the ...

CVE-2020-10758

Keycloak vulnerability CVE-2020-10758 (Keycloak before 11.0.1) enables DoS by sending twenty requests in parallel where each request has a Content-Length larger than the actual body. The underlying issue is a mismatch between declared and actual request size, allowing resource exhaustion that can...

CVE-2020-1717

Keycloak 7.0.1 contains an account email enumeration issue where a logged-in user can determine whether an email is associated with an existing account. The CVE entry notes a low overall CVSS v3.1 base score (2.7) with Confidentiality impact as the primary concern; Privileges Required is High, an...

CVE-2020-10734

Keycloak is affected by CVE-2020-10734 due to missing CSRF protection on the OIDC logout endpoint. The vulnerability is described across multiple sources as affecting Keycloak implementations used with Red Hat Fuse 7, Red Hat SSO 7, and Red Hat OpenShift Application Runtimes, with the OIDC logout...

CVE-2020-14299

CVE-2020-14299 affects Red Hat JBoss Enterprise Application Platform (EAP). The flaw stems from using a legacy SecurityRealm delegating to a legacy PicketBox SecurityDomain and reloading to admin-only mode, enabling complete authentication bypass with an arbitrary user/password. The impact is des...

CVE-2020-1732

CVE-2020-1732 refers to a flaw in Soteria prior to 1.0.1 where concurrent requests using EE Security with WildFly Elytron can cause security identity corruption across threads, potentially allowing an identity from one request to be used in another. Affected: Soteria (security identity handling) ...

CVE-2021-3914

The CVE-2021-3914 issue affects SmallRye Health UI: the health-metrics UI component did not adequately sanitize certain inputs, enabling cross-site scripting. Public references (GHSA and Red Hat advisory) confirm a persistent XSS in the SmallRye health UI endpoint and track a fix in later Red Hat...