CRITICAL9.6

GHSA-j382-5jj3-vw4j

Undertow HTTP server core doesn't properly validate the Host header in incoming HTTP requests

Quick fix

GHSA-j382-5jj3-vw4j — io.undertow:undertow-core: upgrade to the fixed version with the command below.

# pom.xml: bump <version>2.3.21.Final</version> for io.undertow:undertow-core

Details

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests. As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions.

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven/io.undertow:undertow-core

No fixed version published yet for io.undertow:undertow-core (maven). Pin to a known-safe version or switch to an alternative.

Maven/io.undertow:undertow-core

Introduced in: 2.3.0.Alpha1Fixed in: 2.3.21.Final

Fix# pom.xml: bump <version>2.3.21.Final</version> for io.undertow:undertow-core

Maven/io.undertow:undertow-core

Introduced in: 0Fixed in: 2.2.39.Final

Fix# pom.xml: bump <version>2.2.39.Final</version> for io.undertow:undertow-core

Details

Are you affected?

Affected packages

References