CVE catalog

CVE-2022-1319

UBUNTU-CVE-2022-1319

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
1.70% · Oct 25, 2026

A flaw was found in Undertow. For an AJP 400 response, EAP 7 is improperly sending two response packets, and those packets have the reuse flag set even though JBoss EAP closes the connection. A failure occurs when the connection is reused after a 400 by CPING since it reads in the second SEND_HEADERS response packet instead of a CPONG.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Ubuntuundertowpro1.3.4-1vulnerable
Ubuntuundertowpro1.3.5-1vulnerable
Ubuntuundertowpro1.3.7-1vulnerable
Ubuntuundertowpro1.3.11-1vulnerable
Ubuntuundertowpro1.3.16-1vulnerable
Ubuntuundertowpro1.3.16-1ubuntu0.1~esm1vulnerable
Ubuntuundertowpro1.4.20-1vulnerable
Ubuntuundertowpro1.4.21-1vulnerable
Ubuntuundertowpro1.4.22-1vulnerable
Ubuntuundertowpro1.4.23-1vulnerable
Ubuntuundertowpro1.4.23-2build1vulnerable
Ubuntuundertowpro1.4.23-3vulnerable
Ubuntuundertowpro1.4.23-3ubuntu0.1~esm1vulnerable
Ubuntuundertowpro2.0.23-1vulnerable
Ubuntuundertowpro2.0.27-1vulnerable
Ubuntuundertowpro2.0.28-1vulnerable
Ubuntuundertowpro2.0.29-1vulnerable
Ubuntuundertowpro2.0.29-1ubuntu0.1~esm1vulnerable
Ubuntuundertowpro2.2.8-1vulnerable
Ubuntuundertowpro2.2.12-1vulnerable
Ubuntuundertowpro2.2.13-1vulnerable
Ubuntuundertowpro2.2.14-1vulnerable
Ubuntuundertowpro2.2.16-1vulnerable
Ubuntuundertowpro2.2.16-1ubuntu0.1~esm1vulnerable
Ubuntuundertowpro2.3.8-2vulnerable
Ubuntuundertowpro2.3.8-2ubuntu0.1~esm1vulnerable

Fixed-version evidence

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]