VYPR
← All advisories
Low severity2.6NVD Advisory· Published Jul 27, 2018· Updated Jun 17, 2026

CVE-2017-12165

CVE-2017-12165

Description

It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
io.undertow:undertow-coreMaven
< 1.3.311.3.31
io.undertow:undertow-coreMaven
>= 1.4.0, < 1.4.171.4.17
io.undertow:undertow-coreMaven
>= 2.0.0.Alpha1, < 2.0.0.Beta12.0.0.Beta1

Affected products

6
  • Red Hat/Jboss Enterprise Application Platform2 versions
    cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.1.0:*:*:*:*:*:*:*
  • Red Hat/Undertow3 versions
    cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*range: >=1.0.0,<1.3.31
    • cpe:2.3:a:redhat:undertow:2.0.0:alpha_1:*:*:*:*:*:*
    • (no CPE)range: 1.4.17
  • ghsa-coords
    pkg:maven/io.undertow/undertow-core
    Range: < 1.3.31

Patches

Vulnerability mechanics

References

16

News mentions

0

No linked articles in our index yet.