Information Exposure Affecting io.undertow:undertow-core package, versions [2.2.0.Final,]
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JAVA-IOUNDERTOW-8501333
- published13 Dec 2024
- disclosed12 Dec 2024
- creditUnknown
Introduced: 12 Dec 2024
NewCVE-2024-4109 (opens in a new tab)Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
There is no fixed version for io.undertow:undertow-core.
Overview
io.undertow:undertow-core is a Java web server based on non-blocking IO.
Affected versions of this package are vulnerable to Information Exposure via the reuse of HTTP/2 request headers. An attacker can access sensitive information from previous requests by exploiting the incorrect reuse of header values across different streams on the same connection.