CVE catalog

CVE-2017-12165

DEBIAN-CVE-2017-12165

[CVE catalog]

Severity
Low · CVSS 2.6CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
Published
Updated
Source
[NVD] · [CVE record]
EPSS
1.86% · Oct 25, 2026

It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianundertow141.3.11-1vulnerable
Debianundertow141.3.16-1vulnerable
Debianundertow141.3.19-1vulnerable
Debianundertow141.3.21-1vulnerable
Debianundertow141.3.23-1vulnerable
Debianundertow141.3.4-1vulnerable
Debianundertow141.3.5-1vulnerable
Debianundertow141.3.7-1vulnerable
Debianundertow141.4.0-1vulnerable
Debianundertow141.4.1-1vulnerable
Debianundertow141.4.18-1vulnerable
Debianundertow141.4.20-1vulnerable
Debianundertow141.4.21-1vulnerable
Debianundertow141.4.21-2vulnerable
Debianundertow141.4.22-1vulnerable
Debianundertow141.4.23-1vulnerable
Debianundertow141.4.23-2vulnerable
Debianundertow141.4.23-3vulnerable
Debianundertow141.4.25-1vulnerable
Debianundertow141.4.25-2vulnerable
Debianundertow141.4.3-1vulnerable
Debianundertow141.4.4-1vulnerable
Debianundertow141.4.6-1vulnerable
Debianundertow141.4.7-1vulnerable
Debianundertow141.4.8-1vulnerable
Debianundertow142.0.23-1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianundertowdeb142.0.23-1Not reportedDEBIAN-CVE-2017-12165Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]