Undertow vulnerabilities

The Undertow HTTP server library used in WildFly, JBoss EAP, and other Java applications does not properly validate the Host header, allowing malicious requests to be processed.

A vulnerability was found in Undertow that impacts a server supporting the wildfly-http-client protocol. When a malicious user opens and closes a connection with the HTTP port and then closes it immediately, the server may exhaust memory and open file limits. During HTTP upgrade to remoting, WriteTimeoutStreamSinkConduit leaks connections if RemotingConnection is closed by Remoting ServerConnectionOpenListener, leading to a leak of the entire dependency tree.

Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certain configuration limits like message buffer sizes and session timeouts cannot be adjusted and default to being unlimited. This allows a remote attacker to send large amounts of data or maintain connections indefinitely, potentially crashing the server by exhausting its memory or other resources.

A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket messages with permessage-deflate negotiated. This could lead to excessive memory consumption due to the PerMessageDeflateFunction.largerBuffer() method using exponential doubling, resulting in a Denial of Service (DoS) for the affected application.

A flaw in Undertow, an HTTP server, in its HTTP response header writing path. The writeString() method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific Unicode characters in user-controlled input that an application places into response headers, leading to truncation into ASCII control characters or special symbols, potentially resulting in limited integrity impact or information disclosure if the application does not properly sanitize user input.

A flaw was found in the ChunkReader component of the Undertow HTTP server, used by WildFly and JBoss EAP for chunked transfer encoding. The parser uses a single internal variable for both remaining chunk size and state flags, allowing an attacker to craft a request with an extremely large chunk size to overlap these values, tricking the parser into thinking a request has finished prematurely and enabling request smuggling.

A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket handshake.

The Undertow AJP listener honors forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP protocol.

In Undertow, when the first header line of an HTTP request starts with one or more spaces, the server strips these spaces, violating HTTP standards. A remote attacker can exploit this for request smuggling.

A flaw was found in Undertow that allows a remote attacker to craft specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be exploited to launch request smuggling attacks.

A flaw in Undertow allows HTTP request smuggling via the `\r\r\r` header terminator. This can be exploited with certain proxy servers like older Apache Traffic Server and Google Cloud Classic Application Load Balancer.

CVE-2026-3260 has been rejected because Undertow enforces a default maximum HTTP request entity size limit. Any request (including GET or HEAD) with a body exceeding this limit is safely dropped, preventing single-request Resource Exhaustion (Out of Memory) Denial of Service attacks.

A flaw in Undertow causes an OutOfMemoryError when servlets call HttpServletRequestImpl.getParameterNames() with large parameter names. An unauthorized user can exploit this to cause a remote denial-of-service (DoS) attack.

A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to parse large form data encoded with application/x-www-form-urlencoded, the method causes an OutOfMemory issue.

The Undertow server mishandles malformed client requests that trigger server-side stream resets without triggering abuse counters. The 'MadeYouReset' attack allows malicious clients to overload the server by repeatedly aborting streams, leading to denial of service (DoS).

A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a result, different requests may share the same StringBuilder instance, potentially leading to information leakage between requests or responses. In some cases, a value from a previous request may be erroneously reused, leading to unintended data exposure.

A vulnerability in Undertow requires enabling the learning-push handler in the server's config, which is disabled by default. With the default maxAge value of -1, the handler is vulnerable, but if someone overwrites that config, the server is not subject to the attack. The attacker needs to be able to reach the server with a normal HTTP request.

A path traversal vulnerability in Undertow may allow a remote attacker to append a specially-crafted sequence to an HTTP request for an application deployed to JBoss EAP, which may permit access to privileged or restricted files and directories.

In Undertow, a flaw was found where when an AJP request exceeds the max-header-size attribute in ajp-listener, JBoss EAP is marked in an error state by mod_cluster in httpd, causing the TCP connection to close without returning an AJP response. This can allow a malicious user to repeatedly send requests exceeding max-header-size, causing a Denial of Service (DoS).