Product by Red Hat
Undertow
19 known vulnerabilities in Undertow (Red Hat), 0 of them actively exploited (CISA KEV).
Key figures
19
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
5
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2024-1635 | Undertow: out-of-memory error after several closed connections with wildfly-http-client protocol | 7.5 | |
| High | CVE-2025-9784 | Undertow: undertow madeyoureset http/2 ddos vulnerability | 7.5 | |
| High | CVE-2024-5971 | Undertow: response write hangs in case of java 17 tlsv1.3 newsessionticket | 7.5 | |
| High | CVE-2024-7885 | Undertow: improper state management in proxy protocol parsing causes information leakage | 7.5 | |
| Critical | CVE-2025-12543 | Red Hat build of Apache Camel 4.14.4 for Spring Boot 3.5.11: Improper Input Validation | 9.6 | |
| High | CVE-2023-3223 | Undertow: outofmemoryerror due to @multipartconfig handling | 7.5 | |
| High | CVE-2019-14888 | Red Hat Undertow: Uncontrolled Resource Consumption | 7.5 | |
| High | CVE-2024-6162 | Undertow: url-encoded request path information can be broken on ajp-listener | 7.5 | |
| High | CVE-2023-1108 | Undertow: infinite loop in sslconduit during close | 7.5 | |
| Critical | CVE-2019-3888 | Red Hat Undertow: Insertion of Sensitive Information into Log File | 5.3 | |
| High | CVE-2020-1757 | Red Hat Undertow: Improper Input Validation | 8.1 | |
| Critical | CVE-2026-28368 | Undertow: undertow: request smuggling via inconsistent header parsing | 9.1 | |
| Critical | CVE-2026-28369 | Undertow: undertow: request smuggling via malformed http request headers | 9.1 | |
| Medium | CVE-2024-3653 | Undertow: learningpushhandler can lead to remote memory dos attacks | 5.3 | |
| Critical | CVE-2026-28367 | Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator | 8.7 | |
| Medium | CVE-2024-1459 | Undertow: directory traversal vulnerability | 5.3 | |
| High | CVE-2023-5379 | Undertow: ajp request closes connection exceeding maxrequestsize | 7.5 | |
| Medium | CVE-2020-10719 | Red Hat Undertow: HTTP Request/Response Smuggling | 6.5 | |
| High | CVE-2017-12165 | Red Hat Undertow: HTTP Request/Response Smuggling | 2.6 |