EUVD-2026-58670
GHSA-2crv-pxj9-66x8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Upgraded C from N to L because the description explicitly names information disclosure as a possible outcome alongside the confirmed integrity impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The writeString() method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific Unicode characters in user-controlled input that an application places into response headers. This can lead to the truncation of these characters into ASCII control characters or special symbols, potentially resulting in limited integrity impact or information disclosure if the application does not properly sanitize user input.
AnalysisAI
Undertow's HTTP response header writing path silently truncates 16-bit Unicode characters to 8-bit bytes via a narrowing cast in the writeString() method, enabling remote unauthenticated attackers to inject ASCII control characters or special symbols into response headers when an application passes unsanitized user-controlled input into those headers. Affected Red Hat distributions include RHEL 8/9/10, JBoss EAP 7, Red Hat Build of Apache Camel for Spring Boot 4, and Red Hat Single Sign-On 7, as reported by Red Hat via Bugzilla #2516038. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
Undertow is a high-performance, non-blocking Java HTTP server used as the embedded web server in WildFly/JBoss EAP and Red Hat middleware products. The root cause is CWE-681 (Incorrect Conversion Between Numeric Types): Java char is a 16-bit unsigned type representing Unicode code points, but the writeString() method in Undertow's response header encoding path performs an unchecked narrowing cast to byte (8-bit signed). For Unicode code points above U+00FF, the high byte is silently discarded - for example, a character like U+0100 ('Ā') becomes 0x00 (null byte), and U+0D0A becomes 0x0A (newline), potentially enabling header injection. Affected products per CPE include cpe:2.3:a:red_hat:red_hat_build_of_apache_camel_for_spring_boot_4, cpe:2.3:a:red_hat:red_hat_enterprise_linux_8/9/10, and cpe:2.3:a:red_hat:red_hat_jboss_enterprise_application_platform_7. The flaw is in the HTTP/1.1 response serialization layer, not application logic, so any application running on a vulnerable Undertow build and reflectively placing user input into headers is exposed.
RemediationAI
No vendor-released patch version has been independently confirmed from the available data; the Red Hat advisory page at https://access.redhat.com/security/cve/CVE-2026-19879 and Bugzilla entry #2516038 should be monitored for patch releases across affected product lines. Until a patch is applied, the most effective compensating control is ensuring all application code that places user-controlled data into HTTP response headers explicitly strips or encodes non-Latin-1 characters (Unicode code points above U+00FF) before passing them to Undertow - this removes the malformed input before the narrowing cast can produce control characters. Deploying a Web Application Firewall or reverse proxy (such as nginx or Apache httpd) in front of Undertow-based services with rules rejecting Unicode characters in header values adds a defense-in-depth layer, though this may break legitimate internationalized header use cases. Restricting which endpoints accept user-supplied header-reflected input (e.g., disabling open redirects, limiting custom header echo functionality) reduces the attack surface with minimal operational impact.
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
Unauthenticated path traversal in gvproxy, the network forwarder shipped in the gvisor-tap-vsock package (used by Podman
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
Same weakness CWE-681 – Incorrect Conversion between Numeric Types
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today