EUVD-2026-58670
GHSA-2crv-pxj9-66x8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Upgraded C from N to L because the description explicitly names information disclosure as a possible outcome alongside the confirmed integrity impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The writeString() method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific Unicode characters in user-controlled input that an application places into response headers. This can lead to the truncation of these characters into ASCII control characters or special symbols, potentially resulting in limited integrity impact or information disclosure if the application does not properly sanitize user input.
AnalysisAI
Undertow's HTTP response header writing path silently truncates 16-bit Unicode characters to 8-bit bytes via a narrowing cast in the writeString() method, enabling remote unauthenticated attackers to inject ASCII control characters or special symbols into response headers when an application passes unsanitized user-controlled input into those headers. Affected Red Hat distributions include RHEL 8/9/10, JBoss EAP 7, Red Hat Build of Apache Camel for Spring Boot 4, and Red Hat Single Sign-On 7, as reported by Red Hat via Bugzilla #2516038. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concurrent conditions: (1) the target application must place user-controlled input directly into an HTTP response header value without sanitizing or encoding non-ASCII Unicode characters - this is the decisive application-level prerequisite; and (2) the application must be deployed on a vulnerable version of Undertow distributed via Red Hat JBoss EAP 7, RHEL 8/9/10, Red Hat Camel for Spring Boot 4, or Red Hat Single Sign-On 7. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N accurately reflects the limited but network-accessible impact: no authentication barrier, low attack complexity, but constrained to a partial integrity impact with no confidentiality or availability degradation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker submits an HTTP request containing crafted Unicode characters - such as code points whose low byte corresponds to CR (0x0D) or LF (0x0A) - in a parameter that a vulnerable application reflects into an HTTP response header (for example, a Location redirect URL or a custom header). Undertow's `writeString()` method silently truncates the 16-bit Unicode values to 8-bit bytes, injecting raw control characters into the response header stream. … |
| Remediation | No vendor-released patch version has been independently confirmed from the available data; the Red Hat advisory page at https://access.redhat.com/security/cve/CVE-2026-19879 and Bugzilla entry #2516038 should be monitored for patch releases across affected product lines. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Remote code execution in Red Hat Apache Camel Infinispan component allows low-privileged attackers to execute arbitrary
HTTP request smuggling in Undertow's ChunkReader component enables unauthenticated remote attackers to inject out-of-syn
Same weakness CWE-681 – Incorrect Conversion between Numeric Types
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today