{"id":"CVE-2017-12165","aliases":["GHSA-5gg7-5wv8-4gcj"],"url":"https://o3.security/vulnerability/CVE-2017-12165","summary":"Undertow Request Smuggling vulnerability","details":"It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling.","published":"2018-07-27T15:29:00.237Z","modified":"2026-07-08T05:51:23.142590840Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},"epss":{"score":0.01858,"percentile":0.78184,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"io.undertow:undertow-core","fixedVersion":"1.3.31"},{"ecosystem":"Maven","name":"io.undertow:undertow-core","fixedVersion":"1.4.17"},{"ecosystem":"Maven","name":"io.undertow:undertow-core","fixedVersion":"2.0.0.Beta1"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2017:3454"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2017:3455"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2017:3456"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2017:3458"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:0002"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:0003"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:0004"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:0005"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:1322"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12165"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T05:51:23.142590840Z"}}