-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.undertow:undertow-core | maven | < 2.2.36.Final | 2.2.36.Final |
| io.undertow:undertow-core | maven | >= 2.3.0.Alpha1, < 2.3.17.Final | 2.3.17.Final |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from the class-level 'stringBuilder' field being reused across requests. The commit diff shows this field was removed and made local to parseProxyProtocolV1(). Since HTTP connections can handle multiple requests concurrently, the shared mutable StringBuilder could accumulate data from different requests simultaneously, leading to cross-request data leakage. The function parseProxyProtocolV1() is directly responsible for processing proxy protocol headers and was using this vulnerable shared state.
A Semantic Attack on Google Gemini - Read the Latest Research