CVE-2022-1259
CVE-2022-1259
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server. This flaw exists because of an incomplete fix for CVE-2021-3629.
CVSS 7.5 · High · EPSS 1.4%
- Published
- Updated
Stack: system
Affected products and versions
undertow
- Versions
- Fixed in 2.3.0.Final, 2.2.17.SP1, 2.2.20.Final, 2.2.19.SP1.: Affected
No fix published
undertow Ubuntu:Pro:16.04:LTS
- Versions
- 1.3.4-1
- 1.3.5-1
- 1.3.7-1
- 1.3.11-1
- 1.3.16-1
- 1.3.16-1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
undertow Ubuntu:Pro:18.04:LTS
- Versions
- 1.4.20-1
- 1.4.21-1
- 1.4.22-1
- 1.4.23-1
- 1.4.23-2build1
- 1.4.23-3
- 1.4.23-3ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
undertow Ubuntu:Pro:20.04:LTS
- Versions
- 2.0.23-1
- 2.0.27-1
- 2.0.28-1
- 2.0.29-1
- 2.0.29-1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
undertow Ubuntu:Pro:22.04:LTS
- Versions
- 2.2.8-1
- 2.2.12-1
- 2.2.13-1
- 2.2.14-1
- 2.2.16-1
- 2.2.16-1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
undertow Ubuntu:Pro:24.04:LTS
- Versions
- 2.3.8-2
- 2.3.8-2ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
undertow Ubuntu:25.10
- Versions
- 2.3.18-1
- 2.3.18-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
undertow Ubuntu:26.10
- Versions
- 2.3.20-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
undertow Ubuntu:26.04:LTS
- Versions
- 2.3.18-2
- 2.3.20-1
- 2.3.20-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published