Improper Neutralization of CRLF Sequences in Wildfly Undertow

Also known as GHSA-qcqr-hcjq-whfq

Published 10 y ago 2016-09-26 · modified 4 mo ago 2026-06-17 · JSON

CVSS

6.1

v3.0 · NVD

CISA KEV

not known exploited

EPSS

2.5%

percentile 85%

Public exploits

none known

CRLF injection vulnerability in the Undertow web server in WildFly 10.0.0, as used in Red Hat JBoss Enterprise Application Platform (EAP) 7.x before 7.0.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

Exploit prediction (EPSS)

2.55% probability of exploitation in the next 30 days, higher than 85% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	6.1	`CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
NVD	2.0	4.3	`AV:N/AC:M/Au:N/C:N/I:P/A:N`
GitHub	3.0	6.1	`CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`

Affected packages

Ecosystem	Package	Affected	Fixed in
maven	`org.wildfly:wildfly-undertow`	>=10.0.0.Final, <11.0.0.Final	11.0.0.Final

Classification

Weakness

CWE-93 Improper Neutralization of CRLF Sequences
CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers

References

rhn.redhat.com /errata/RHSA-2016-1841.html · vendor-advisory, x_refsource_REDHAT, x_transferred
securityfocus.com /bid/92894 · vdb-entry, x_refsource_BID, x_transferred
access.redhat.com /errata/RHSA-2017:3458 · vendor-advisory, x_refsource_REDHAT, x_transferred
securitytracker.com /id/1036758 · vdb-entry, x_refsource_SECTRACK, x_transferred
rhn.redhat.com /errata/RHSA-2016-1838.html · vendor-advisory, x_refsource_REDHAT, x_transferred
access.redhat.com /errata/RHSA-2017:3455 · vendor-advisory, x_refsource_REDHAT, x_transferred
access.redhat.com /errata/RHSA-2017:3456 · vendor-advisory, x_refsource_REDHAT, x_transferred
bugzilla.redhat.com /show_bug.cgi?id=1344321 · x_refsource_CONFIRM, x_transferred
access.redhat.com /errata/RHSA-2017:3454 · vendor-advisory, x_refsource_REDHAT, x_transferred
rhn.redhat.com /errata/RHSA-2016-1839.html · vendor-advisory, x_refsource_REDHAT, x_transferred
rhn.redhat.com /errata/RHSA-2016-1840.html · vendor-advisory, x_refsource_REDHAT, x_transferred
nvd.nist.gov /vuln/detail/CVE-2016-4993 · advisory
github.com /undertow-io/undertow/commit/834496fb74ddda2af197940c70d08bab419fdf12 · web
issues.redhat.com /browse/UNDERTOW-827 · web

Sources

CVE List: CVE-2016-4993
GitHub Advisory: GHSA-qcqr-hcjq-whfq
NVD: CVE-2016-4993

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.