CVE-2017-12165
It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.86%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling.
- CVSS 3.0
- 7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 1.86% probability · 79th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-444
- Affected
- redhat/undertow · redhat/jboss enterprise application platform
- Source
- secalert@redhat.com
EPSS 1.9% since 27 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- https://access.redhat.com/errata/RHSA-2017:3454Vendor Advisory
- https://access.redhat.com/errata/RHSA-2017:3455Vendor Advisory
- https://access.redhat.com/errata/RHSA-2017:3456Vendor Advisory
- https://access.redhat.com/errata/RHSA-2017:3458Vendor Advisory
- https://access.redhat.com/errata/RHSA-2018:0002Vendor Advisory
- https://access.redhat.com/errata/RHSA-2018:0003Vendor Advisory
- https://access.redhat.com/errata/RHSA-2018:0004Vendor Advisory
- https://access.redhat.com/errata/RHSA-2018:0005Vendor Advisory
- https://access.redhat.com/errata/RHSA-2018:1322Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12165Issue Tracking, Vendor Advisory
- https://access.redhat.com/errata/RHSA-2017:3454Vendor Advisory
- https://access.redhat.com/errata/RHSA-2017:3455Vendor Advisory
- https://access.redhat.com/errata/RHSA-2017:3456Vendor Advisory
- https://access.redhat.com/errata/RHSA-2017:3458Vendor Advisory
- https://access.redhat.com/errata/RHSA-2018:0002Vendor Advisory
- https://access.redhat.com/errata/RHSA-2018:0003Vendor Advisory
- https://access.redhat.com/errata/RHSA-2018:0004Vendor Advisory
- https://access.redhat.com/errata/RHSA-2018:0005Vendor Advisory
- https://access.redhat.com/errata/RHSA-2018:1322Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12165Issue Tracking, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.