Bug 2516038 (CVE-2026-19879) - CVE-2026-19879 io.undertow/undertow: Undertow: HTTP response header integrity issue due to character truncation
Summary: CVE-2026-19879 io.undertow/undertow: Undertow: HTTP response header integrity...
Keywords:
Status: NEW
Alias: CVE-2026-19879
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-14 14:30 UTC by OSIDB Bzimport
Modified: 2026-08-14 14:36 UTC (History)
39 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-08-14 14:30:07 UTC
A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The `writeString()` method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific Unicode characters in user-controlled input that an application places into response headers. This can lead to the truncation of these characters into ASCII control characters or special symbols, potentially resulting in limited integrity impact or information disclosure if the application does not properly sanitize user input.


Note You need to log in before you can comment on or make changes to this bug.