CVE catalog

CVE-2018-1114

DEBIAN-CVE-2018-1114

[CVE catalog]

Severity
Medium · CVSS 6.5CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
2.33% · Oct 25, 2026

It was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized which can cause file descriptors to exhaust. This leads to a file handler leak.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianundertow141.3.11-1vulnerable
Debianundertow141.3.16-1vulnerable
Debianundertow141.3.19-1vulnerable
Debianundertow141.3.21-1vulnerable
Debianundertow141.3.23-1vulnerable
Debianundertow141.3.4-1vulnerable
Debianundertow141.3.5-1vulnerable
Debianundertow141.3.7-1vulnerable
Debianundertow141.4.0-1vulnerable
Debianundertow141.4.1-1vulnerable
Debianundertow141.4.18-1vulnerable
Debianundertow141.4.20-1vulnerable
Debianundertow141.4.21-1vulnerable
Debianundertow141.4.21-2vulnerable
Debianundertow141.4.22-1vulnerable
Debianundertow141.4.23-1vulnerable
Debianundertow141.4.23-2vulnerable
Debianundertow141.4.23-3vulnerable
Debianundertow141.4.3-1vulnerable
Debianundertow141.4.4-1vulnerable
Debianundertow141.4.6-1vulnerable
Debianundertow141.4.7-1vulnerable
Debianundertow141.4.8-1vulnerable
Debianundertow141.4.25-1fixed
Ubuntuundertowpro2.3.8-2vulnerable
Ubuntuundertowpro2.3.8-2ubuntu0.1~esm1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianundertowdeb141.4.25-1Not reportedDEBIAN-CVE-2018-1114Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]