-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from how Undertow's HTTP request parser handled path normalization. The commit diff shows added state tracking (PATH_SEGMENT_START/PATH_DOT_SEGMENT) and explicit handling of semicolons in dot segments. The test cases demonstrate that pre-patch versions would collapse '/..;/' into '../' during parsing. The handlePath function is directly modified in the patch to prevent this insecure normalization, confirming it as the vulnerable component.
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.undertow:undertow-core | maven | < 2.2.31.Final | 2.2.31.Final |
| io.undertow:undertow-core | maven | >= 2.3.0.Alpha1, < 2.3.12.Final | 2.3.12.Final |
Ongoing coverage of React2Shell