GitHub Advisoryadvisory · Maven

GHSA-5gg7-5wv8-4gcj Undertow Request Smuggling vulnerability

HIGH Published 2022-05-13 Modified 2024-03-20 Official page ↗
Aliases
CVE-2017-12165
Ecosystem
Maven
Packages
io.undertow:undertow-core
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-444
Reviewed
2022-11-08

Affected packages

• Maven io.undertow:undertow-core: < 1.3.31 → fixed in 1.3.31 • Maven io.undertow:undertow-core: >= 1.4.0, < 1.4.17 → fixed in 1.4.17 • Maven io.undertow:undertow-core: >= 2.0.0.Alpha1, < 2.0.0.Beta1 → fixed in 2.0.0.Beta1

Description

It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling.

Related

Alias · CVE (1)

  • CVE-2017-12165 It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause… vulnerability

Weakness · CWE (1)

  • CWE-444 Inconsistent Interpretation of HTTP Requests weakness

References