CVE-2017-12165

undertow: improper whitespace parsing leading to potential HTTP request smuggling

Published Jul 27, 2018 CVSS 3.0 · 2.6 Low EPSS 1.9% KEV · Not listed
Description
It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2022-2579 It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling.
Github GHSA Github GHSA GHSA-5gg7-5wv8-4gcj Undertow Request Smuggling vulnerability
History
Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7
Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 5, 2024, 6:28 PM
Reserved
Aug 1, 2017, 12:00 AM
Status
Modified
Published
Jul 27, 2018, 3:29 PM
Modified
Jun 17, 2026, 1:02 AM
Severity
Low
Public date
Dec 13, 2017, 12:00 AM