A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The `writeString()` method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific Unicode characters in user-controlled input that an application places into response headers. This can lead to the truncation of these characters into ASCII control characters or special symbols, potentially resulting in limited integrity impact or information disclosure if the application does not properly sanitize user input.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Redhat Subscribe
Camel Spring Boot Subscribe
Enterprise Linux Subscribe
Jboss Enterprise Application Platform Subscribe
Jbosseapxp Subscribe
Red Hat Single Sign On Subscribe

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

Applications utilizing Undertow should implement robust input validation and sanitization for all user-controlled data before it is placed into HTTP response headers. It is recommended to restrict header values to printable ASCII characters (0x20–0x7E) at the application level. Where available, use framework-provided header-safe encoding mechanisms to ensure proper handling of special characters.

References
Link Providers
https://access.redhat.com/security/cve/CVE-2026-19879 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2516038 cve-icon cve-icon
History

Fri, 14 Aug 2026 15:00:00 +0000

Type Values Removed Values Added
Description A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The `writeString()` method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific Unicode characters in user-controlled input that an application places into response headers. This can lead to the truncation of these characters into ASCII control characters or special symbols, potentially resulting in limited integrity impact or information disclosure if the application does not properly sanitize user input.
Title Io.undertow/undertow: undertow: http response header integrity issue due to character truncation
First Time appeared Redhat
Redhat camel Spring Boot
Redhat enterprise Linux
Redhat jboss Enterprise Application Platform
Redhat jbosseapxp
Redhat red Hat Single Sign On
Weaknesses CWE-681
CPEs cpe:/a:redhat:camel_spring_boot:4
cpe:/a:redhat:jboss_enterprise_application_platform:7
cpe:/a:redhat:jboss_enterprise_application_platform:8
cpe:/a:redhat:jbosseapxp
cpe:/a:redhat:red_hat_single_sign_on:7
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat camel Spring Boot
Redhat enterprise Linux
Redhat jboss Enterprise Application Platform
Redhat jbosseapxp
Redhat red Hat Single Sign On
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-08-14T14:51:36.106Z

Reserved: 2026-08-14T14:26:12.605Z

Link: CVE-2026-19879

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-14T15:17:09.310

Modified: 2026-08-14T15:17:09.310

Link: CVE-2026-19879

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-14T16:30:05Z

Weaknesses