Vulnerability GHSA-vqqj-9cmv-hx43
High Risk
HIGH RISK
CVSS Score: 8.7
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
7 months ago
March 27, 2026 at 06:31 PM UTC
Undertow is Vulnerable to HTTP Request/Response Smuggling
1.0.0.Alpha1 - 2.2.39.Final and 2.3.0.Final - 2.3.24.Final
1.0.0.Alpha1 - 2.2.39.Final and 2.3.0.Final - 2.3.24.Final
Summary
Undertow is Vulnerable to HTTP Request/Response Smuggling
Details
A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly processes the request by stripping these leading spaces. This behavior, which violates HTTP standards, can be exploited by a remote attacker to perform request smuggling. Request smuggling allows an attacker to bypass security mechanisms, access restricted information, or manipulate web caches, potentially leading to unauthorized actions or data exposure.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
7 months ago
Undertow is Vulnerable to HTTP Request/Response Smuggling
1.0.0.Alpha1 - 2.2.39.Final and 2.3.0.Final - 2.3.24.Final GHSA-3gv6-g396-9v4r
1.0.0.Alpha1 - 2.2.39.Final and 2.3.0.Final - 2.3.24.Final GHSA-3gv6-g396-9v4r
High Risk
7 months ago
Undertow is Vulnerable to HTTP Request/Response Smuggling
1.0.0.Alpha1 - 2.2.39.Final and 2.3.0.Final - 2.3.24.Final GHSA-8v4x-mgvp-p658
1.0.0.Alpha1 - 2.2.39.Final and 2.3.0.Final - 2.3.24.Final GHSA-8v4x-mgvp-p658
Medium Risk
7 months ago
Undertow: Denial of Service via Multipart/Form-Data Parsing on HTTP GET Requests
1.0.0.Alpha1 - 2.4.4.Final GHSA-3x3v-w654-m28m
1.0.0.Alpha1 - 2.4.4.Final GHSA-3x3v-w654-m28m
High Risk
9 months ago
Undertow Servlets Vulnerable to Remote DoS via OutOfMemoryError when Passed Large Parameter Names
1.0.0.Alpha1 - 2.2.38.Final and 2.3.0.Alpha1 - 2.3.20.Final and 2.4.0.Alpha1 GHSA-33hj-rcmx-86mv
1.0.0.Alpha1 - 2.2.38.Final and 2.3.0.Alpha1 - 2.3.20.Final and 2.4.0.Alpha1 GHSA-33hj-rcmx-86mv
Critical
10 months ago
Undertow HTTP server core doesn't properly validate the Host header in incoming HTTP requests
1.0.0.Alpha1 - 2.2.38.Final and 2.3.0.Alpha1 - 2.3.20.Final and 2.4.0.Alpha1 GHSA-j382-5jj3-vw4j
1.0.0.Alpha1 - 2.2.38.Final and 2.3.0.Alpha1 - 2.3.20.Final and 2.4.0.Alpha1 GHSA-j382-5jj3-vw4j
Impacted packages
Timeline
Published
7 months ago
March 27, 2026 at 06:31 PM UTC
Fixed (2.2.40.Final)
Unknown
Unknown
Fixed (2.3.25.Final)
Unknown
Unknown
Last Modified
3 hours ago
November 04, 2026 at 09:00 PM UTC