Medium severity6.1NVD Advisory· Published Sep 26, 2016· Updated Jun 17, 2026
CVE-2016-4993
CVE-2016-4993
Description
CRLF injection vulnerability in the Undertow web server in WildFly 10.0.0, as used in Red Hat JBoss Enterprise Application Platform (EAP) 7.x before 7.0.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.wildfly:wildfly-undertowMaven | >= 10.0.0.Final, < 11.0.0.Final | 11.0.0.Final |
Affected products
3- cpe:2.3:a:redhat:jboss_enterprise_application_platform:*:*:*:*:*:*:*:*Range: <=7.0.1
- cpe:2.3:a:redhat:jboss_wildfly_application_server:10.0.0:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
15- rhn.redhat.com/errata/RHSA-2016-1838.htmlnvdThird Party AdvisoryWEB
- rhn.redhat.com/errata/RHSA-2016-1839.htmlnvdThird Party AdvisoryWEB
- rhn.redhat.com/errata/RHSA-2016-1840.htmlnvdThird Party AdvisoryWEB
- rhn.redhat.com/errata/RHSA-2016-1841.htmlnvdThird Party AdvisoryWEB
- www.securitytracker.com/id/1036758nvdThird Party Advisory
- bugzilla.redhat.com/show_bug.cginvdIssue TrackingThird Party AdvisoryWEB
- github.com/advisories/GHSA-qcqr-hcjq-whfqghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2016-4993ghsaADVISORY
- access.redhat.com/errata/RHSA-2017:3454nvdWEB
- access.redhat.com/errata/RHSA-2017:3455nvdWEB
- access.redhat.com/errata/RHSA-2017:3456nvdWEB
- access.redhat.com/errata/RHSA-2017:3458nvdWEB
- github.com/undertow-io/undertow/commit/834496fb74ddda2af197940c70d08bab419fdf12ghsaWEB
- issues.redhat.com/browse/UNDERTOW-827ghsaWEB
- www.securityfocus.com/bid/92894nvd
News mentions
0No linked articles in our index yet.