Source: undertow Version: 2.3.20-1 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerability was published for undertow. CVE-2026-19879[0]: | A flaw was found in Undertow, an HTTP server, within its HTTP | response header writing path. The `writeString()` method performs a | silent narrowing cast from 16-bit Unicode characters to 8-bit bytes | when writing HTTP response header values. A remote attacker can | exploit this by supplying specific Unicode characters in user- | controlled input that an application places into response headers. | This can lead to the truncation of these characters into ASCII | control characters or special symbols, potentially resulting in | limited integrity impact or information disclosure if the | application does not properly sanitize user input. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-19879 https://www.cve.org/CVERecord?id=CVE-2026-19879 [1] https://bugzilla.redhat.com/show_bug.cgi?id=2516038 Regards, Salvatore
