Vulnerability-Lookup

CVE-2022-1259 (GCVE-0-2022-1259)

Vulnerability from cvelistv5 – Published: 2022-08-31 00:00 – Updated: 2024-08-02 23:55

Summary

A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server. This flaw exists because of an incomplete fix for CVE-2021-3629.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-400 - - Uncontrolled Resource Consumption.

Assigner

redhat redhat root

References

3 references

URL	Tags
https://bugzilla.redhat.com/show_bug.cgi?id=2072339
https://access.redhat.com/security/cve/CVE-2022-1259
https://security.netapp.com/advisory/ntap-2022101…

Impacted products

1 product

Vendor	Product	Version	CPE status
n/a	undertow	Affected: Fixed in 2.3.0.Final, 2.2.17.SP1, 2.2.20.Final, 2.2.19.SP1.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:55:24.711Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2072339"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2022-1259"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20221014-0006/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "undertow",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed in 2.3.0.Final, 2.2.17.SP1, 2.2.20.Final, 2.2.19.SP1."
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server. This flaw exists because of an incomplete fix for CVE-2021-3629."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400 - Uncontrolled Resource Consumption.",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-10-14T00:00:00.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2072339"
        },
        {
          "url": "https://access.redhat.com/security/cve/CVE-2022-1259"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20221014-0006/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2022-1259",
    "datePublished": "2022-08-31T00:00:00.000Z",
    "dateReserved": "2022-04-06T00:00:00.000Z",
    "dateUpdated": "2024-08-02T23:55:24.711Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-1259",
      "date": "2026-09-15",
      "epss": "0.01296",
      "percentile": "0.68777"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:build_of_quarkus:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CE29B9D6-63DC-4779-ACE8-4E51E6A0AF37\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:integration_camel_k:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B87C8AD3-8878-4546-86C2-BF411876648C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"72A54BDA-311C-413B-8E4D-388AD65A170A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A33441B3-B301-426C-A976-08CE5FE72EFB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9EFEC7CA-8DDA-48A6-A7B6-1F1D14792890\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"2.2.17\", \"matchCriteriaId\": \"41DB9F22-47FB-4D66-9EA0-10BAFE1D9EE5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:undertow:2.2.18:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"69DCCF80-32AD-4E27-871D-0FE5DF57CEF6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:undertow:2.2.19:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F5E73C11-3855-4A12-90A9-3AB29235BB57\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*\", \"matchCriteriaId\": \"F3E0B672-3E06-4422-B2A4-0BD073AEC2A1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*\", \"matchCriteriaId\": \"3A756737-1CC4-42C2-A4DF-E1C893B4E2D5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*\", \"matchCriteriaId\": \"B55E8D50-99B4-47EC-86F9-699B67D473CE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:cloud_secure_agent:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F0F202E8-97E6-4BBB-A0B6-4CA3F5803C08\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F1BE6C1F-2565-4E97-92AA-16563E5660A5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5735E553-9731-4AAC-BCFF-989377F817B3\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server. This flaw exists because of an incomplete fix for CVE-2021-3629.\"}, {\"lang\": \"es\", \"value\": \"Se ha encontrado un fallo en Undertow. Un posible problema de seguridad en la administraci\\u00f3n del control de flujo por parte del navegador sobre HTTP/2 puede causar una sobrecarga o una denegaci\\u00f3n de servicio en el servidor. Este fallo se presenta debido a una correcci\\u00f3n incompleta de CVE-2021-3629\"}]",
      "id": "CVE-2022-1259",
      "lastModified": "2024-11-21T06:40:21.637",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 3.6}]}",
      "published": "2022-08-31T16:15:09.230",
      "references": "[{\"url\": \"https://access.redhat.com/security/cve/CVE-2022-1259\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2072339\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Issue Tracking\", \"Vendor Advisory\"]}, {\"url\": \"https://security.netapp.com/advisory/ntap-20221014-0006/\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://access.redhat.com/security/cve/CVE-2022-1259\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2072339\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Issue Tracking\", \"Vendor Advisory\"]}, {\"url\": \"https://security.netapp.com/advisory/ntap-20221014-0006/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}]",
      "sourceIdentifier": "secalert@redhat.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"secalert@redhat.com\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-400\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-1259\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2022-08-31T16:15:09.230\",\"lastModified\":\"2026-06-17T04:22:06.423\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server. This flaw exists because of an incomplete fix for CVE-2021-3629.\"},{\"lang\":\"es\",\"value\":\"Se ha encontrado un fallo en Undertow. Un posible problema de seguridad en la administraci\u00f3n del control de flujo por parte del navegador sobre HTTP/2 puede causar una sobrecarga o una denegaci\u00f3n de servicio en el servidor. Este fallo se presenta debido a una correcci\u00f3n incompleta de CVE-2021-3629\"}],\"affected\":[{\"source\":\"secalert@redhat.com\",\"affectedData\":[{\"vendor\":\"n/a\",\"product\":\"undertow\",\"versions\":[{\"version\":\"Fixed in 2.3.0.Final, 2.2.17.SP1, 2.2.20.Final, 2.2.19.SP1.\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-400\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:build_of_quarkus:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CE29B9D6-63DC-4779-ACE8-4E51E6A0AF37\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:integration_camel_k:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B87C8AD3-8878-4546-86C2-BF411876648C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"72A54BDA-311C-413B-8E4D-388AD65A170A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A33441B3-B301-426C-A976-08CE5FE72EFB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9EFEC7CA-8DDA-48A6-A7B6-1F1D14792890\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2.2.17\",\"matchCriteriaId\":\"41DB9F22-47FB-4D66-9EA0-10BAFE1D9EE5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:undertow:2.2.18:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"69DCCF80-32AD-4E27-871D-0FE5DF57CEF6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:undertow:2.2.19:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F5E73C11-3855-4A12-90A9-3AB29235BB57\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*\",\"matchCriteriaId\":\"F3E0B672-3E06-4422-B2A4-0BD073AEC2A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*\",\"matchCriteriaId\":\"3A756737-1CC4-42C2-A4DF-E1C893B4E2D5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*\",\"matchCriteriaId\":\"B55E8D50-99B4-47EC-86F9-699B67D473CE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:cloud_secure_agent:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F0F202E8-97E6-4BBB-A0B6-4CA3F5803C08\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F1BE6C1F-2565-4E97-92AA-16563E5660A5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5735E553-9731-4AAC-BCFF-989377F817B3\"}]}]}],\"references\":[{\"url\":\"https://access.redhat.com/security/cve/CVE-2022-1259\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2072339\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20221014-0006/\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://access.redhat.com/security/cve/CVE-2022-1259\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2072339\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20221014-0006/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-20T02:10:33+00:00",
      "cve": "CVE-2022-1259",
      "id": "CVE-2022-1259",
      "initial_release_date": "2022-04-06T00:00:00+00:00",
      "product_status:fixed": "100",
      "product_status:known_affected": "8",
      "product_status:known_not_affected": "3296",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "undertow: potential security issue in flow control over HTTP/2 may lead to DOS(incomplete fix for CVE-2021-3629)",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-1259.json",
      "version": "3"
    }
  }
}

RHSA-2022_5532

Vulnerability from csaf_redhat - Published: 2022-07-07 14:19 - Updated: 2024-11-26 03:08

Summary

Red Hat Security Advisory: Red Hat Fuse 7.11.0 release and security update

Severity

Important

Scope

58 vulnerabilities in this advisory, including CVE-2022-1259.

CVE-2022-1259

A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 1 product

https://access.redhat.com/errata/RHSA-2022:5532

Open the full advisory

RHSA-2022_6821

Vulnerability from csaf_redhat - Published: 2022-10-05 16:36 - Updated: 2024-12-16 16:05

Summary

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.7 Security update

Severity

Important

Scope

3 vulnerabilities in this advisory, including CVE-2022-1259.

CVE-2022-1259

A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 2 products Known not affected: 117 products

https://access.redhat.com/errata/RHSA-2022:6821

Open the full advisory

RHSA-2022_6822

Vulnerability from csaf_redhat - Published: 2022-10-05 17:03 - Updated: 2024-12-16 16:05

Summary

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.7 Security update

Severity

Important

Scope

3 vulnerabilities in this advisory, including CVE-2022-1259.

CVE-2022-1259

A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 2 products Known not affected: 115 products

https://access.redhat.com/errata/RHSA-2022:6822

Open the full advisory

RHSA-2022_6823

Vulnerability from csaf_redhat - Published: 2022-10-05 16:35 - Updated: 2024-12-16 16:05

Summary

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.7 Security update

Severity

Important

Scope

3 vulnerabilities in this advisory, including CVE-2022-1259.

CVE-2022-1259

A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 2 products Known not affected: 112 products

https://access.redhat.com/errata/RHSA-2022:6823

Open the full advisory

RHSA-2022_6825

Vulnerability from csaf_redhat - Published: 2022-10-05 16:46 - Updated: 2024-12-16 16:05

Summary

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.7 Security update

Severity

Important

Scope

3 vulnerabilities in this advisory, including CVE-2022-1259.

CVE-2022-1259

A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 1 product

https://access.redhat.com/errata/RHSA-2022:6825

Open the full advisory

RHSA-2022_8761

Vulnerability from csaf_redhat - Published: 2022-12-14 13:17 - Updated: 2024-11-22 20:14

Summary

Red Hat Security Advisory: Red Hat support for Spring Boot 2.7.2 update

Severity

Moderate

Scope

6 vulnerabilities in this advisory, including CVE-2022-1259.

CVE-2022-1259

A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 1 product

https://access.redhat.com/errata/RHSA-2022:8761

Open the full advisory

RHSA-2025:9582

Vulnerability from csaf_redhat - Published: 2025-06-25 00:21 - Updated: 2026-09-07 14:19

Summary

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.11 on RHEL 7 security update

Severity

Important

Scope

14 vulnerabilities in this advisory, including CVE-2022-1259.

CVE-2022-1259

A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 37 products

https://access.redhat.com/errata/RHSA-2025:9582

Open the full advisory

RHSA-2025:9583

Vulnerability from csaf_redhat - Published: 2025-06-25 00:16 - Updated: 2026-08-25 09:28

Summary

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.14 Security update

Severity

Important

Scope

14 vulnerabilities in this advisory, including CVE-2022-1259.

CVE-2022-1259

A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 53 products

https://access.redhat.com/errata/RHSA-2025:9583

Open the full advisory

ubuntu-cve-2022-1259

Vulnerability from osv_ubuntu

Published

2022-08-31 16:15

Modified

2026-05-20 14:55

Summary

Details

Severity

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2022-1259	REPORT
	https://www.cve.org/CVERecord?id=CVE-2022-1259	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libundertow-java",
            "binary_version": "1.3.16-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "undertow",
        "purl": "pkg:deb/ubuntu/undertow@1.3.16-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.3.4-1",
        "1.3.5-1",
        "1.3.7-1",
        "1.3.11-1",
        "1.3.16-1",
        "1.3.16-1ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libundertow-java",
            "binary_version": "1.4.23-3ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "undertow",
        "purl": "pkg:deb/ubuntu/undertow@1.4.23-3ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.4.20-1",
        "1.4.21-1",
        "1.4.22-1",
        "1.4.23-1",
        "1.4.23-2build1",
        "1.4.23-3",
        "1.4.23-3ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libundertow-java",
            "binary_version": "2.0.29-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "undertow",
        "purl": "pkg:deb/ubuntu/undertow@2.0.29-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.0.23-1",
        "2.0.27-1",
        "2.0.28-1",
        "2.0.29-1",
        "2.0.29-1ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libundertow-java",
            "binary_version": "2.2.16-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "undertow",
        "purl": "pkg:deb/ubuntu/undertow@2.2.16-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.2.8-1",
        "2.2.12-1",
        "2.2.13-1",
        "2.2.14-1",
        "2.2.16-1",
        "2.2.16-1ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libundertow-java",
            "binary_version": "2.3.8-2ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:24.04:LTS",
        "name": "undertow",
        "purl": "pkg:deb/ubuntu/undertow@2.3.8-2ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.3.8-2",
        "2.3.8-2ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libundertow-java",
            "binary_version": "2.3.18-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "undertow",
        "purl": "pkg:deb/ubuntu/undertow@2.3.18-2?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.3.18-1",
        "2.3.18-2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libundertow-java",
            "binary_version": "2.3.20-1ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "undertow",
        "purl": "pkg:deb/ubuntu/undertow@2.3.20-1ubuntu1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.3.18-2",
        "2.3.20-1",
        "2.3.20-1ubuntu1"
      ]
    }
  ],
  "aliases": [],
  "details": "A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server. This flaw exists because of an incomplete fix for CVE-2021-3629.",
  "id": "UBUNTU-CVE-2022-1259",
  "modified": "2026-05-20T14:55:17Z",
  "published": "2022-08-31T16:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-1259"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-1259"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2022-1259"
  ]
}

WID-SEC-W-2022-0607

Vulnerability from csaf_certbund - Published: 2022-07-07 22:00 - Updated: 2025-11-18 23:00

Summary

Red Hat FUSE: Mehrere Schwachstellen

Severity

Hoch

Scope

58 vulnerabilities in this advisory, including CVE-2022-1259.

CVE-2022-1259

Known affected: 15 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2022-1259 (GCVE-0-2022-1259)

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature