CVE-2017-12165

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-444

Affected software

Vendor	Product	Versions
Red Hat	undertow	1.4.17; 1.3.31; 2.0.0

References

https://access.redhat.com/errata/RHSA-2017:3454Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:3455Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:3456Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:3458Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:0002Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:0003Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:0004Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:0005Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:1322Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12165Issue Tracking, Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:3454Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:3455Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:3456Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:3458Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:0002Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:0003Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:0004Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:0005Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:1322Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12165Issue Tracking, Vendor Advisory

Timeline

Published: Jul 27, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-121669.8OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1 is used, possibly r CVE-2017-121675.5It was found in EAP 7 before 7.0.9 that properties based files of the management and the application realm configuration that contain user t CVE-2017-121686.0The access_pmu_evcntr function in arch/arm64/kvm/sys_regs.c in the Linux kernel before 4.8.11 allows privileged KVM guest OS users to cause CVE-2017-121697.5It was found that FreeIPA 4.2.0 and later could disclose password hashes to users having the 'System: Read Stage Users' permission. A remote CVE-2017-12176.1IBM WebSphere Portal 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code i CVE-2017-121709.8Downstream version 1.0.46-1 of pure-ftpd as shipped in Fedora was vulnerable to packaging error due to which the original configuration was CVE-2017-121716.5A regression was found in the Red Hat Enterprise Linux 6.9 version of httpd 2.2.15-60, causing comments in the "Allow" and "Deny" configurat CVE-2017-121726.7PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20, and 9.2.x before 9.2.24 runs CVE-2017-121738.8It was found that sssd's sysdb_search_user_by_upn_res() function before 1.16.0 did not sanitize requests when querying its local cache and w CVE-2017-121747.5It was found that when Artemis and HornetQ before 2.4.0 are configured with UDP discovery and JGroups discovery a huge byte array is created CVE-2017-121755.4Red Hat Satellite before 6.5 is vulnerable to a XSS in discovery rule when you are entering filter and you use autocomplete functionality.CVE-2017-121769.8xorg-x11-server before 1.19.5 was missing extra length validation in ProcEstablishConnection function allowing malicious X client to cause X