{"id":"CVE-2017-12165","aliases":["GHSA-5gg7-5wv8-4gcj"],"url":"https://o3.security/vulnerability/CVE-2017-12165","summary":"Undertow Request Smuggling vulnerability","details":"It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling.","published":"2018-07-27T15:29:00.237Z","modified":"2026-10-24T10:30:55.423320420Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},"epss":{"score":0.01858,"percentile":0.78184,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"io.undertow:undertow-core","fixedVersion":"1.3.31"},{"ecosystem":"Maven","name":"io.undertow:undertow-core","fixedVersion":"1.4.17"},{"ecosystem":"Maven","name":"io.undertow:undertow-core","fixedVersion":"2.0.0.Beta1"}],"fix":{"url":"https://github.com/undertow-io/undertow/commit/1e72647818c9fb31b693a953b1ae595a6c82eb7f","label":"undertow-io/undertow@1e72647"},"references":[{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2017:3454"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2017:3455"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2017:3456"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2017:3458"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:0002"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:0003"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:0004"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:0005"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:1322"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12165"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-12165"},{"type":"WEB","url":"https://github.com/undertow-io/undertow/commit/1e72647818c9fb31b693a953b1ae595a6c82eb7f"},{"type":"WEB","url":"https://github.com/undertow-io/undertow/commit/5b008b7ac312c6cdb76679ff58c43620bb79d44f"},{"type":"WEB","url":"https://github.com/undertow-io/undertow/commit/691440ee58259fba76711b60d56dde6679808bdc"},{"type":"PACKAGE","url":"https://github.com/undertow-io/undertow"},{"type":"WEB","url":"https://issues.redhat.com/browse/UNDERTOW-1251"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-24T10:30:55.423320420Z"}}