CVE-2026-19879Medium· 5.3▾ SunlitA flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The `writeString()` method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header value…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.4%
A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The writeString() method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific Unicode characters in user-controlled input that an application places into response headers. This can lead to the truncation of these characters into ASCII control characters or special symbols, potentially resulting in limited integrity impact or information disclosure if the application does not properly sanitize user input.
undertow-core (all versions)undertow-parent (all versions)undertow-servlet (all versions)undertow-websockets-jsr (all versions)moditect (all versions)pki-core:10.6/resteasy (all versions)pki-deps:10.6/resteasy (all versions)resteasy (all versions)jboss-eap-7/eap74-els-openjdk11-openshift-rhel8 (all versions)jboss-eap-7/eap74-els-openjdk17-openshift-rhel8 (all versions)jboss-eap-7/eap74-els-openjdk8-openshift-rhel8 (all versions)undertow-core (all versions)undertow-parent (all versions)undertow-servlet (all versions)undertow-websockets-jsr (all versions)undertow-core (all versions)undertow-servlet (all versions)undertow-websockets-jsr (all versions)undertow-core (all versions)undertow-servlet (all versions)undertow-websockets-jsr (all versions)undertow-core (all versions)undertow-servlet (all versions)undertow-websockets-jsr (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Applications utilizing Undertow should implement robust input validation and sanitization for all user-controlled data before it is placed into HTTP response headers. It is recommended to restrict header values to printable ASCII characters (0x20–0x7E) at the application level. Where available, use framework-provided header-safe encoding mechanisms to ensure proper handling of special characters.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-98869High· 7.8kernel: bpf: Infer zext_dst based on static register liveness analysis (CVE-2026-98869)
CVE-2026-98590Medium· 6.7kernel: bpf: Fix bpf_sock context code generation (CVE-2026-98590)
CVE-2026-88387Medium· 5.5LibRaw 0.22.0 contains an incorrect numeric conversion vulnerability in LibRaw::parse_tiff_ifd() when processing TIFF tag 0x00fe (NewSubfileType)
CVE-2026-88367Medium· 6.5NanoSVG 239e102ec contains an incorrect numeric conversion vulnerability in nsvg__curveDivs() during SVG stroke rasterization
CVE-2026-6426Medium· 4.4A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling
CVE-2026-81624High· 7.5Undertow is a flexible performant web server used in JBoss EAP and WildFly