Vulnerability GHSA-3gv6-g396-9v4r
High Risk
HIGH RISK
CVSS Score: 8.7
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
7 months ago
March 27, 2026 at 06:31 PM UTC
Undertow is Vulnerable to HTTP Request/Response Smuggling
1.0.0.Alpha1 - 2.2.39.Final and 2.3.0.Final - 2.3.24.Final
1.0.0.Alpha1 - 2.2.39.Final and 2.3.0.Final - 2.3.24.Final
Summary
Undertow is Vulnerable to HTTP Request/Response Smuggling
Details
A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending \r\r\r as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
7 months ago
Undertow is Vulnerable to HTTP Request/Response Smuggling
1.0.0.Alpha1 - 2.2.39.Final and 2.3.0.Final - 2.3.24.Final GHSA-8v4x-mgvp-p658
1.0.0.Alpha1 - 2.2.39.Final and 2.3.0.Final - 2.3.24.Final GHSA-8v4x-mgvp-p658
High Risk
7 months ago
Undertow is Vulnerable to HTTP Request/Response Smuggling
1.0.0.Alpha1 - 2.2.39.Final and 2.3.0.Final - 2.3.24.Final GHSA-vqqj-9cmv-hx43
1.0.0.Alpha1 - 2.2.39.Final and 2.3.0.Final - 2.3.24.Final GHSA-vqqj-9cmv-hx43
Medium Risk
7 months ago
Undertow: Denial of Service via Multipart/Form-Data Parsing on HTTP GET Requests
1.0.0.Alpha1 - 2.4.4.Final GHSA-3x3v-w654-m28m
1.0.0.Alpha1 - 2.4.4.Final GHSA-3x3v-w654-m28m
High Risk
9 months ago
Undertow Servlets Vulnerable to Remote DoS via OutOfMemoryError when Passed Large Parameter Names
1.0.0.Alpha1 - 2.2.38.Final and 2.3.0.Alpha1 - 2.3.20.Final and 2.4.0.Alpha1 GHSA-33hj-rcmx-86mv
1.0.0.Alpha1 - 2.2.38.Final and 2.3.0.Alpha1 - 2.3.20.Final and 2.4.0.Alpha1 GHSA-33hj-rcmx-86mv
Critical
10 months ago
Undertow HTTP server core doesn't properly validate the Host header in incoming HTTP requests
1.0.0.Alpha1 - 2.2.38.Final and 2.3.0.Alpha1 - 2.3.20.Final and 2.4.0.Alpha1 GHSA-j382-5jj3-vw4j
1.0.0.Alpha1 - 2.2.38.Final and 2.3.0.Alpha1 - 2.3.20.Final and 2.4.0.Alpha1 GHSA-j382-5jj3-vw4j
Impacted packages
Timeline
Published
7 months ago
March 27, 2026 at 06:31 PM UTC
Fixed (2.3.25.Final)
Unknown
Unknown
Fixed (2.2.40.Final)
Unknown
Unknown
Last Modified
2 hours ago
November 04, 2026 at 09:30 PM UTC