CVE-2017-7559

N/A

Published: January 10, 2018 at 03:00 PM UTC

Updated: June 17, 2026 at 01:24 AM UTC

1 product affected across 1 vendorUndertow

Using undertow by Red Hat, Inc.?

Get instant alerts when new vulnerabilities affect undertow - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

N/A

Exploit prediction

EPSS 2%

Description

In Undertow 2.x before 2.0.0.Alpha2, 1.4.x before 1.4.17.Final, and 1.3.x before 1.3.31.Final, it was found that the fix for CVE-2017-2666 was incomplete and invalid characters are still allowed in the query string and path parameters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other than their own.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Undertow · Red Hat

95%

1.3 ≤ v < 1.3.31.Final1.3.0 ≤ v < 1.3.311.4 ≤ v < 1.4.17.Final1.4.0 ≤ v < 1.4.172 ≤ v < 2.0.0.Alpha22.0.0 alpha1

Affected range stops below 1.3.31, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.3.31.Final, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.4.17, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.4.17.Final, so it looks safe — our inference, not a vendor statement

Affected range stops below 2.0.0.Alpha2, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references