VYPR
← All advisories
High severity7.5NVD Advisory· Published Jan 23, 2020· Updated Jun 17, 2026

CVE-2019-14888

CVE-2019-14888

Description

A vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS. An attacker can target the HTTPS port to carry out a Denial Of Service (DOS) to make the service unavailable on SSL.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
io.undertow:undertow-coreMaven
< 2.0.29.Final2.0.29.Final

Affected products

12
  • NetApp/Active Iq Unified Manager3 versions
    cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*+ 2 more
    • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*
    • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
    • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
  • Red Hat/DataGrid2 versions
    cpe:2.3:a:redhat:jboss_data_grid:-:*:*:*:text-only:*:*:*+ 1 more
    • cpe:2.3:a:redhat:jboss_data_grid:-:*:*:*:text-only:*:*:*
    • cpe:2.3:a:redhat:jboss_data_grid:7.0.0:*:*:*:*:*:*:*
  • Red Hat/Jboss Enterprise Application Platform
    cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*
  • Red Hat/Jboss Fuse2 versions
    cpe:2.3:a:redhat:jboss_fuse:6.0.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:redhat:jboss_fuse:6.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:*
  • Red Hat/Single Sign On
    cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*
  • Red Hat/Undertow2 versions
    cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*range: <=2.0.28
    • (no CPE)range: All versions before 2.0.28.SP1
  • ghsa-coords
    pkg:maven/io.undertow/undertow-core
    Range: < 2.0.29.Final

Patches

Vulnerability mechanics

References

6

News mentions

0

No linked articles in our index yet.