PkgSeer

Vulnerability GHSA-j382-5jj3-vw4j

Critical
CRITICAL RISK
CVSS Score: 9.6
Score Range: 9.0–10.0
Critical severity vulnerabilities (CVSS 9.0–10.0). These represent the highest impact issues.
10 months ago
January 07, 2026 at 06:30 PM UTC
Undertow HTTP server core doesn't properly validate the Host header in incoming HTTP requests
1.0.0.Alpha1 - 2.2.38.Final and 2.3.0.Alpha1 - 2.3.20.Final and 2.4.0.Alpha1
1.0.0.Alpha1 - 2.2.38.Final and 2.3.0.Alpha1 - 2.3.20.Final and 2.4.0.Alpha1

Summary

Undertow HTTP server core doesn't properly validate the Host header in incoming HTTP requests

Details

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests. As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.

Related Vulnerabilities

Other vulnerabilities affecting the same packages

High Risk
7 months ago
Undertow is Vulnerable to HTTP Request/Response Smuggling
1.0.0.Alpha1 - 2.2.39.Final and 2.3.0.Final - 2.3.24.Final GHSA-3gv6-g396-9v4r
1.0.0.Alpha1 - 2.2.39.Final and 2.3.0.Final - 2.3.24.Final GHSA-3gv6-g396-9v4r
High Risk
7 months ago
Undertow is Vulnerable to HTTP Request/Response Smuggling
1.0.0.Alpha1 - 2.2.39.Final and 2.3.0.Final - 2.3.24.Final GHSA-8v4x-mgvp-p658
1.0.0.Alpha1 - 2.2.39.Final and 2.3.0.Final - 2.3.24.Final GHSA-8v4x-mgvp-p658
High Risk
7 months ago
Undertow is Vulnerable to HTTP Request/Response Smuggling
1.0.0.Alpha1 - 2.2.39.Final and 2.3.0.Final - 2.3.24.Final GHSA-vqqj-9cmv-hx43
1.0.0.Alpha1 - 2.2.39.Final and 2.3.0.Final - 2.3.24.Final GHSA-vqqj-9cmv-hx43
Medium Risk
7 months ago
Undertow: Denial of Service via Multipart/Form-Data Parsing on HTTP GET Requests
1.0.0.Alpha1 - 2.4.4.Final GHSA-3x3v-w654-m28m
1.0.0.Alpha1 - 2.4.4.Final GHSA-3x3v-w654-m28m
High Risk
9 months ago
Undertow Servlets Vulnerable to Remote DoS via OutOfMemoryError when Passed Large Parameter Names
1.0.0.Alpha1 - 2.2.38.Final and 2.3.0.Alpha1 - 2.3.20.Final and 2.4.0.Alpha1 GHSA-33hj-rcmx-86mv
1.0.0.Alpha1 - 2.2.38.Final and 2.3.0.Alpha1 - 2.3.20.Final and 2.4.0.Alpha1 GHSA-33hj-rcmx-86mv
View all vulnerabilities for these packages

Impacted packages

Timeline

Published
10 months ago
January 07, 2026 at 06:30 PM UTC
Fixed (2.3.21.Final)
Unknown
Unknown
Fixed (2.2.39.Final)
Unknown
Unknown
Last Modified
1 month ago
September 10, 2026 at 03:50 AM UTC