CVE catalog

CVE-2017-2666

undertow - security update

[CVE catalog]

Severity
Medium · CVSS 6.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Published
Updated
Source
[NVD] · [CVE record]
EPSS
3.09% · Oct 25, 2026

It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other than their own.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianundertow141.3.11-1vulnerable
Debianundertow141.3.16-1vulnerable
Debianundertow141.3.19-1vulnerable
Debianundertow141.3.21-1vulnerable
Debianundertow141.3.23-1vulnerable
Debianundertow141.3.4-1vulnerable
Debianundertow141.3.5-1vulnerable
Debianundertow141.3.7-1vulnerable
Debianundertow141.4.0-1vulnerable
Debianundertow141.4.1-1vulnerable
Debianundertow141.4.3-1vulnerable
Debianundertow141.4.4-1vulnerable
Debianundertow141.4.6-1vulnerable
Debianundertow141.4.7-1vulnerable
Debianundertow141.4.8-1vulnerable
Debianundertow141.4.18-1fixed
Ubuntuundertowpro2.3.8-2vulnerable
Ubuntuundertowpro2.3.8-2ubuntu0.1~esm1vulnerable
Debianundertow91.4.8-1vulnerable
Debianundertow91.4.8-1+deb9u1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianundertowdeb141.4.18-1Not reportedDEBIAN-CVE-2017-2666Not reported
Debianundertowdeb91.4.8-1+deb9u1Not reportedDSA-3906-1Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]