Vulnerability GHSA-8v4x-mgvp-p658
High Risk
HIGH RISK
CVSS Score: 8.7
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
7 months ago
March 27, 2026 at 06:31 PM UTC
Undertow is Vulnerable to HTTP Request/Response Smuggling
1.0.0.Alpha1 - 2.2.39.Final and 2.3.0.Final - 2.3.24.Final
1.0.0.Alpha1 - 2.2.39.Final and 2.3.0.Final - 2.3.24.Final
Summary
Undertow is Vulnerable to HTTP Request/Response Smuggling
Details
A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be exploited to launch request smuggling attacks, potentially bypassing security controls and accessing unauthorized resources.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
7 months ago
Undertow is Vulnerable to HTTP Request/Response Smuggling
1.0.0.Alpha1 - 2.2.39.Final and 2.3.0.Final - 2.3.24.Final GHSA-3gv6-g396-9v4r
1.0.0.Alpha1 - 2.2.39.Final and 2.3.0.Final - 2.3.24.Final GHSA-3gv6-g396-9v4r
High Risk
7 months ago
Undertow is Vulnerable to HTTP Request/Response Smuggling
1.0.0.Alpha1 - 2.2.39.Final and 2.3.0.Final - 2.3.24.Final GHSA-vqqj-9cmv-hx43
1.0.0.Alpha1 - 2.2.39.Final and 2.3.0.Final - 2.3.24.Final GHSA-vqqj-9cmv-hx43
Medium Risk
7 months ago
Undertow: Denial of Service via Multipart/Form-Data Parsing on HTTP GET Requests
1.0.0.Alpha1 - 2.4.4.Final GHSA-3x3v-w654-m28m
1.0.0.Alpha1 - 2.4.4.Final GHSA-3x3v-w654-m28m
High Risk
9 months ago
Undertow Servlets Vulnerable to Remote DoS via OutOfMemoryError when Passed Large Parameter Names
1.0.0.Alpha1 - 2.2.38.Final and 2.3.0.Alpha1 - 2.3.20.Final and 2.4.0.Alpha1 GHSA-33hj-rcmx-86mv
1.0.0.Alpha1 - 2.2.38.Final and 2.3.0.Alpha1 - 2.3.20.Final and 2.4.0.Alpha1 GHSA-33hj-rcmx-86mv
Critical
10 months ago
Undertow HTTP server core doesn't properly validate the Host header in incoming HTTP requests
1.0.0.Alpha1 - 2.2.38.Final and 2.3.0.Alpha1 - 2.3.20.Final and 2.4.0.Alpha1 GHSA-j382-5jj3-vw4j
1.0.0.Alpha1 - 2.2.38.Final and 2.3.0.Alpha1 - 2.3.20.Final and 2.4.0.Alpha1 GHSA-j382-5jj3-vw4j
Impacted packages
Timeline
Published
7 months ago
March 27, 2026 at 06:31 PM UTC
Fixed (2.2.40.Final)
Unknown
Unknown
Fixed (2.3.25.Final)
Unknown
Unknown
Last Modified
2 hours ago
November 04, 2026 at 09:30 PM UTC