5.9

CVSS Score

3.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2016-7046

CVE-2016-7046: Undertow Uncaught Exception vulnerability

A long URL proxy request lead to java.nio.BufferOverflowException in Undertow.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2016-7046

CVE-2016-7046:

5.9

CVSS Score

3.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
io.undertow:undertow-core	maven	>= 1.4.0, < 1.4.3.Final	1.4.3.Final
io.undertow:undertow-core	maven	< 1.3.25.Final	1.3.25.Final

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stems from improper buffer management in HttpRequestConduit.java's processWrite method. The pre-patch code in STATE_START (lines 126-141) used assertions to validate buffer capacity but lacked proper handling for oversized URLs. The patch introduced a length check (line 130-133) and a fallback path (lines 145-156) to write the URL incrementally via STATE_URL. The unpatched code's direct buffer writes without overflow checks allowed BufferOverflowExceptions when URLs exceeded buffer limits, triggering an uncaught exception loop. The HpackEncoder.java changes addressed secondary overflow scenarios, but the root cause was in HttpRequestConduit's request line construction logic.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.