How many CVEs have a located fix in undertow-io/undertow?

22 published CVEs have a fix traced to functions in undertow-io/undertow, touching 132 functions across 74 files.

Which function in undertow-io/undertow has been patched by the most CVEs?

handleEventWithNoRunningRequest in core/src/main/java/io/undertow/server/protocol/http/HttpReadListener.java has been changed by 4 CVE fixes, from 2018 to 2026.

How large is a typical CVE fix in undertow-io/undertow?

The median fix changes 67 lines. 27% of fixes change 20 lines or fewer, and 14% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

java

#234 of 500 repositories

undertow-io/undertow

Name: undertow-io/undertow: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix January 30, 2026

22

CVE fixes located

Published CVEs

132

Functions patched

Distinct function sites

74

Files patched

Distinct source files

2014–2026

Years covered

By CVE publication date

Overview

22 published CVEs have a fix traced to functions in undertow-io/undertow, the earliest published in 2014. Those fixes changed 132 distinct functions across 74 files, in 737 patch hunks.

Among the 500 repositories tracked here, undertow-io/undertow ranks #234 by the number of CVEs with a located fix.

Most patched functions

Functions in undertow-io/undertow changed by the most CVE fixes.

Most patched files

Files in undertow-io/undertow changed by the most CVE fixes.

1core/src/main/java/io/undertow/server/protocol/http/HttpRequestParser.java6 CVEs · 6 functions
2core/src/main/java/io/undertow/server/protocol/http2/Http2ReceiveListener.java5 CVEs · 3 functions
3core/src/main/java/io/undertow/server/Connectors.java4 CVEs · 4 functions
4core/src/main/java/io/undertow/server/protocol/ajp/AjpRequestParser.java4 CVEs · 3 functions
5core/src/main/java/io/undertow/server/protocol/http/HttpReadListener.java4 CVEs · 2 functions
6core/src/main/java/io/undertow/protocols/http2/Http2Channel.java3 CVEs · 8 functions
7core/src/main/java/io/undertow/server/HttpServerExchange.java3 CVEs · 5 functions
8core/src/main/java/io/undertow/protocols/http2/HpackEncoder.java3 CVEs · 3 functions
9core/src/main/java/io/undertow/server/handlers/form/MultiPartParserDefinition.java3 CVEs · 3 functions
10core/src/main/java/io/undertow/server/handlers/proxy/ProxyHandler.java3 CVEs · 2 functions

Fix size

How much code a CVE fix in undertow-io/undertow changes, with backports counted once.

67

Median lines changed

Added plus removed, per CVE

27%

Fixes of 20 lines or fewer

Share of CVE fixes

14%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in undertow-io/undertow, and the functions each fix changed.

Undertow: outofmemoryerror in httpservletrequestimpl.getparameternames() can cause remote dos attacks
CVE-2024-4027NetworkUtils setNonDecodedQueryString parse
High · CVSS 7.5
EPSS 0.4%2026-01-30
Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded
CVE-2024-3884NetworkUtils setNonDecodedQueryString get
High · CVSS 7.5
EPSS 1.4%2025-12-03
Undertow: undertow madeyoureset http/2 ddos vulnerability
CVE-2025-9784free receive write
High · CVSS 7.5
EPSS 2.3%2025-09-02
Undertow: cookie smuggling/spoofing
CVE-2023-4639ThreadLocalCache readFile FormValueImpl
High · CVSS 7.4
EPSS 1.1%2024-11-17
Undertow Denial of Service vulnerability
CVE-2023-1973storeInitialLocation FormAuthenticationMechanism handleRedirectBack
Medium · CVSS 6.6
EPSS 1.3%2024-11-07
Undertow: improper state management in proxy protocol parsing causes information leakage
CVE-2024-7885parseProxyProtocolV1 ProxyProtocolReadListener
High · CVSS 8.7
EPSS 2.6%2024-08-21
Undertow: url-encoded request path information can be broken on ajp-listener
CVE-2024-6162getMaxHeaderSize Http2Channel decode
High · CVSS 8.7
EPSS 1.7%2024-06-20
Undertow: out-of-memory error after several closed connections with wildfly-http-client protocol
CVE-2024-1635synchronized handlePath handleStateful
High · CVSS 8.7
EPSS 4.6%2024-02-19
Undertow: directory traversal vulnerability
CVE-2024-1459handlePath handleStateful sanitazeListTypeHeaders
Medium · CVSS 5.3
EPSS 1.7%2024-02-12
Undertow denial of service vulnerability
CVE-2023-1108wrapAndFlip
High · CVSS 7.5
EPSS 1.8%2023-09-14
Undertow client not checking server identity presented by server certificate in https connections
CVE-2022-4492set getProperty createSSLEngine
Critical · CVSS 9.8
EPSS 0.6%2023-02-23
CVE-2022-1319
CVE-2022-1319AjpReadListener handleEvent
High · CVSS 7.5
EPSS 1.6%2022-08-31

Get an alert for each new undertow-io/undertow CVE, with the patched functions and AI-written analysis.

Monitor undertow CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

BerriAI/litellm22 CVEs cockpit-hq/cockpit22 CVEs cvat-ai/cvat22 CVEs exponentcms/exponent-cms22 CVEs frappe/erpnext22 CVEs GNOME/libxml222 CVEs libgd/libgd22 CVEs nuxt/nuxt22 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in undertow-io/undertow.

How many CVEs have a located fix in undertow-io/undertow?: 22 published CVEs have a fix traced to functions in undertow-io/undertow, touching 132 functions across 74 files.
Which function in undertow-io/undertow has been patched by the most CVEs?: handleEventWithNoRunningRequest in core/src/main/java/io/undertow/server/protocol/http/HttpReadListener.java has been changed by 4 CVE fixes, from 2018 to 2026.
How large is a typical CVE fix in undertow-io/undertow?: The median fix changes 67 lines. 27% of fixes change 20 lines or fewer, and 14% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track undertow-io/undertow CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing