CVE-2026-91920

The Undertow HTTP server library used in WildFly, JBoss EAP, and other Java applications does not properly validate the Host header, allowing malicious requests to be processed.

A vulnerability was found in Undertow that impacts a server supporting the wildfly-http-client protocol. When a malicious user opens and closes a connection with the HTTP port and then closes it immediately, the server may exhaust memory and open file limits. During HTTP upgrade to remoting, WriteTimeoutStreamSinkConduit leaks connections if RemotingConnection is closed by Remoting ServerConnectionOpenListener, leading to a leak of the entire dependency tree.

In the PathResourceManager component of the Undertow web server, the mechanism verifying whether a symbolic link points to a safe location only checks if the target path starts with a specific string, without ensuring it matches a full directory name. This could allow an attacker to access files in a sibling directory whose name starts with the same characters as an authorized safe directory.

Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certain configuration limits like message buffer sizes and session timeouts cannot be adjusted and default to being unlimited. This allows a remote attacker to send large amounts of data or maintain connections indefinitely, potentially crashing the server by exhausting its memory or other resources.

A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket messages with permessage-deflate negotiated. This could lead to excessive memory consumption due to the PerMessageDeflateFunction.largerBuffer() method using exponential doubling, resulting in a Denial of Service (DoS) for the affected application.

A flaw in Undertow, an HTTP server, in its HTTP response header writing path. The writeString() method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific Unicode characters in user-controlled input that an application places into response headers, leading to truncation into ASCII control characters or special symbols, potentially resulting in limited integrity impact or information disclosure if the application does not properly sanitize user input.

A flaw was found in the ChunkReader component of the Undertow HTTP server, used by WildFly and JBoss EAP for chunked transfer encoding. The parser uses a single internal variable for both remaining chunk size and state flags, allowing an attacker to craft a request with an extremely large chunk size to overlap these values, tricking the parser into thinking a request has finished prematurely and enabling request smuggling.

A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket handshake.

The Undertow AJP listener honors forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP protocol.

In Undertow, when the first header line of an HTTP request starts with one or more spaces, the server strips these spaces, violating HTTP standards. A remote attacker can exploit this for request smuggling.