Patchfirst
Patchfirst
ChainRed Hat · undertowMaven:io.undertow:undertow-core

Red Hat undertow: incomplete fixes (2016–2024)

16 CVEs over 5 generations, 26 Sep 2016 to 30 Jan 2026.

Family tree

Left to right by publication date.Oldest first. Select a CVE to open it.
  1. CVE-2016-499326 Sep 2016 First in the chain
  2. CVE-2016-70463 Oct 2016 related to CVE-2016-4993
  3. CVE-2017-755910 Jan 2018 incomplete fix for CVE-2017-2666
  4. CVE-2017-1219618 Apr 2018 next fix after CVE-2017-7559
  5. CVE-2018-106721 May 2018 incomplete fix for CVE-2016-4993
  6. CVE-2017-1216527 Jul 2018 related to CVE-2016-4993next fix after CVE-2016-7046and 1 more
  7. CVE-2017-266627 Jul 2018 next fix after CVE-2016-7046
  8. CVE-2020-1068723 Sep 2020 related to CVE-2017-2666
  9. CVE-2021-2022023 Feb 2021 regression of CVE-2020-10687related to CVE-2017-12165and 1 more
  10. CVE-2021-369023 Aug 2022 No direct link to an earlier CVE
  11. CVE-2021-385926 Aug 2022 related to CVE-2016-4993related to CVE-2016-7046
  12. CVE-2022-449223 Feb 2023 No direct link to an earlier CVE
  13. CVE-2024-163519 Feb 2024 related to CVE-2017-12165
  14. CVE-2024-616220 Jun 2024 related to CVE-2017-12165
  15. CVE-2024-38843 Dec 2025 related to CVE-2017-12196related to CVE-2017-12165and 3 more
  16. CVE-2024-402730 Jan 2026 related to CVE-2017-12196related to CVE-2017-12165and 4 more
20162017201820192020202120222023202420252026 CVE-2016-4993 → CVE-2018-1067: incomplete fix (high confidence)CVE-2017-7559 → CVE-2017-2666: incomplete fix (high confidence)CVE-2020-10687 → CVE-2021-20220: regression of (high confidence)CVE-2016-4993 → CVE-2016-7046: related (medium confidence)CVE-2016-4993 → CVE-2017-12165: related (medium confidence)CVE-2016-4993 → CVE-2021-3859: related (medium confidence)CVE-2016-7046 → CVE-2021-3859: related (medium confidence)CVE-2017-12196 → CVE-2024-3884: related (medium confidence)CVE-2017-12196 → CVE-2024-4027: related (medium confidence)CVE-2017-12165 → CVE-2021-20220: related (medium confidence)CVE-2017-12165 → CVE-2024-1635: related (medium confidence)CVE-2017-12165 → CVE-2024-3884: related (medium confidence)CVE-2017-12165 → CVE-2024-4027: related (medium confidence)CVE-2017-12165 → CVE-2024-6162: related (medium confidence)CVE-2017-2666 → CVE-2020-10687: related (medium confidence)CVE-2017-2666 → CVE-2021-20220: related (medium confidence)CVE-2021-3690 → CVE-2024-3884: related (medium confidence)CVE-2021-3690 → CVE-2024-4027: related (medium confidence)CVE-2022-4492 → CVE-2024-3884: related (medium confidence)CVE-2022-4492 → CVE-2024-4027: related (medium confidence)CVE-2024-6162 → CVE-2024-3884: related (medium confidence)CVE-2024-6162 → CVE-2024-4027: related (medium confidence)CVE-2024-3884 → CVE-2024-4027: related (medium confidence)CVE-2016-7046 → CVE-2017-12165: Next fix in the same package (low confidence)CVE-2016-7046 → CVE-2017-2666: Next fix in the same package (low confidence)CVE-2017-7559 → CVE-2017-12165: Next fix in the same package (low confidence)CVE-2017-7559 → CVE-2017-12196: Next fix in the same package (low confidence) CVE-2016-4993 26 Sep 2016 CVE-2016-7046 3 Oct 2016 CVE-2017-7559 10 Jan 2018 CVE-2017-12196 18 Apr 2018 CVE-2018-1067 21 May 2018 CVE-2017-12165 27 Jul 2018 CVE-2017-2666 27 Jul 2018 CVE-2020-10687 23 Sep 2020 CVE-2021-20220 23 Feb 2021 CVE-2021-3690 23 Aug 2022 CVE-2021-3859 26 Aug 2022 CVE-2022-4492 23 Feb 2023 CVE-2024-1635 19 Feb 2024 CVE-2024-6162 20 Jun 2024 CVE-2024-3884 3 Dec 2025 CVE-2024-4027 30 Jan 2026 20162017201820192020202120222023202420252026 CVE-2016-4993 → CVE-2018-1067: incomplete fix (high confidence)CVE-2017-7559 → CVE-2017-2666: incomplete fix (high confidence)CVE-2020-10687 → CVE-2021-20220: regression of (high confidence)CVE-2016-4993 → CVE-2016-7046: related (medium confidence)CVE-2016-4993 → CVE-2017-12165: related (medium confidence)CVE-2016-4993 → CVE-2021-3859: related (medium confidence)CVE-2016-7046 → CVE-2021-3859: related (medium confidence)CVE-2017-12196 → CVE-2024-3884: related (medium confidence)CVE-2017-12196 → CVE-2024-4027: related (medium confidence)CVE-2017-12165 → CVE-2021-20220: related (medium confidence)CVE-2017-12165 → CVE-2024-1635: related (medium confidence)CVE-2017-12165 → CVE-2024-3884: related (medium confidence)CVE-2017-12165 → CVE-2024-4027: related (medium confidence)CVE-2017-12165 → CVE-2024-6162: related (medium confidence)CVE-2017-2666 → CVE-2020-10687: related (medium confidence)CVE-2017-2666 → CVE-2021-20220: related (medium confidence)CVE-2021-3690 → CVE-2024-3884: related (medium confidence)CVE-2021-3690 → CVE-2024-4027: related (medium confidence)CVE-2022-4492 → CVE-2024-3884: related (medium confidence)CVE-2022-4492 → CVE-2024-4027: related (medium confidence)CVE-2024-6162 → CVE-2024-3884: related (medium confidence)CVE-2024-6162 → CVE-2024-4027: related (medium confidence)CVE-2024-3884 → CVE-2024-4027: related (medium confidence)CVE-2016-7046 → CVE-2017-12165: Next fix in the same package (low confidence)CVE-2016-7046 → CVE-2017-2666: Next fix in the same package (low confidence)CVE-2017-7559 → CVE-2017-12165: Next fix in the same package (low confidence)CVE-2017-7559 → CVE-2017-12196: Next fix in the same package (low confidence) CVE-2016-4993 26 Sep 2016 CVE-2016-7046 3 Oct 2016 CVE-2017-7559 10 Jan 2018 CVE-2017-12196 18 Apr 2018 CVE-2018-1067 21 May 2018 CVE-2017-12165 27 Jul 2018 CVE-2017-2666 27 Jul 2018 CVE-2020-10687 23 Sep 2020 CVE-2021-20220 23 Feb 2021 CVE-2021-3690 23 Aug 2022 CVE-2021-3859 26 Aug 2022 CVE-2022-4492 23 Feb 2023 CVE-2024-1635 19 Feb 2024 CVE-2024-6162 20 Jun 2024 CVE-2024-3884 3 Dec 2025 CVE-2024-4027 30 Jan 2026
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low

CVEs in this family

Table view of the tree
CVEPublishedTitleLinked fromPriority
CVE-2016-4993 26 Sep 2016 CRLF injection vulnerability in the Undertow web server in WildFly 10.0.0, as used in Red Hat JBoss Enterprise… First in chain 17.0
CVE-2016-7046 3 Oct 2016 Red Hat JBoss Enterprise Application Platform (EAP) 7, when operating as a reverse-proxy with default buffer sizes… · fixed in 1.4.3.Final CVE-2016-4993 · related · Medium 16.9
CVE-2017-7559 10 Jan 2018 In Undertow 2.x before 2.0.0.Alpha2, 1.4.x before 1.4.17.Final, and 1.3.x before 1.3.31.Final, it was found that the… · fixed in 2.0.0.Alpha2 CVE-2017-2666 · incomplete fix · High 16.0
CVE-2017-12196 18 Apr 2018 undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication… · fixed in 2.0.2.FInal CVE-2017-7559 · Next fix in the same package · Low 19.5
CVE-2018-1067 21 May 2018 In Undertow before versions 7.1.2.CR1, 7.1.2.GA it was found that the fix for CVE-2016-4993 was incomplete and… · fixed in 7.1.2.GA CVE-2016-4993 · incomplete fix · High 19.4
CVE-2017-12165 27 Jul 2018 It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual… · fixed in 2.0.0.Beta1 CVE-2016-4993 · related · Medium 17.7
CVE-2017-2666 27 Jul 2018 It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters · fixed in 1.4.17 CVE-2016-7046 · Next fix in the same package · Low 22.1
CVE-2020-10687 23 Sep 2020 A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to… · fixed in 2.2.0.Final CVE-2017-2666 · related · Medium 13.8
CVE-2021-20220 23 Feb 2021 A flaw was found in Undertow · fixed in 2.1.6 CVE-2020-10687 · regression of · High 13.6
CVE-2021-3690 23 Aug 2022 A flaw was found in Undertow · fixed in 2.2.10 First in chain 15.6
CVE-2021-3859 26 Aug 2022 A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2 · fixed in 2.2.15 CVE-2016-4993 · related · Medium 15.5
CVE-2022-4492 23 Feb 2023 The undertow client is not checking the server identity presented by the server certificate in https connections · fixed in 2.3.5.Final First in chain 9.7
CVE-2024-1635 19 Feb 2024 Undertow: out-of-memory error after several closed connections with wildfly-http-client protocol · fixed in 2.3.12.Final CVE-2017-12165 · related · Medium 23.6
CVE-2024-6162 20 Jun 2024 Undertow: url-encoded request path information can be broken on ajp-listener · fixed in 2.3.14.Final CVE-2017-12165 · related · Medium 20.7
CVE-2024-3884 3 Dec 2025 Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded · fixed in 2.4.0.Beta1 CVE-2017-12196 · related · Medium 19.6
CVE-2024-4027 30 Jan 2026 Undertow: outofmemoryerror in httpservletrequestimpl.getparameternames() can cause remote dos attacks · fixed in 2.4.0.Beta1 CVE-2017-12196 · related · Medium 12.1
↑ ↓ chooseEnter openEsc close