GHSA-qjwc-v72v-fq6r is a medium-severity (CVSS 4.8) CWE-444 vulnerability in io.undertow:undertow-core. A fix is available for io.undertow:undertow-core — see the affected versions and patch details below.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
GHSA-qjwc-v72v-fq6r by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 385,987 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
io.undertow:undertow-core☕io.undertow:undertow-coreReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.
Description
A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from request other than their own. The highest threat from this vulnerability is to data confidentiality and integrity.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| ☕Maven | io.undertow:undertow-core | ≥ 2.1.0&&< 2.1.6 | 2.1.6io.undertow:undertow-core:2.1.6 |
| ☕Maven | io.undertow:undertow-core | all versions | 2.0.34io.undertow:undertow-core:2.0.34 |
Affected Products
active iq unified managernetapponcommand workflow automationnetappundertowredhatDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for io.undertow:undertow-core, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update io.undertow:undertow-core to 2.1.6 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-qjwc-v72v-fq6r is resolved across your whole dependency graph.
Workarounds
Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
| Product | Fixed in | Advisory |
|---|---|---|
| Red Hat EAP-XP 2.0.0 via EAP 7.3.x base | wildfly-undertow | RHSA-2021:2755 |
| Red Hat EAP-XP via EAP 7.3.x base | wildfly-undertow | RHSA-2021:2210 |
| Red Hat JBoss Enterprise Application Platform 7 | wildfly-undertow | RHSA-2021:0885 |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6 | eap7-activemq-artemis-0:2.9.0-9.redhat_00019.1.el6eap | RHSA-2021:0872 |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7 | eap7-activemq-artemis-0:2.9.0-9.redhat_00019.1.el7eap | RHSA-2021:0873 |
| Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8 | eap7-activemq-artemis-0:2.9.0-9.redhat_00019.1.el8eap | RHSA-2021:0874 |
| Red Hat Single Sign-On 7.4.6 | wildfly-undertow | RHSA-2021:0974 |
Frequently Asked Questions
Is GHSA-qjwc-v72v-fq6r in your dependencies?
Find it across Maven, including transitive dependencies.