CVE-2026-19879Io.undertow/undertow: undertow: http response header integrity issue due to character truncation

Description

A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The `writeString()` method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific Unicode characters in user-controlled input that an application places into response headers. This can lead to the truncation of these characters into ASCII control characters or special symbols, potentially resulting in limited integrity impact or information disclosure if the application does not properly sanitize user input.

Timeline

Scores

EPSS (exploitation in 30 days)

0.39% · top 66% of all CVEs (12 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.

Affected products

• Red Hat · Red Hat build of Apache Camel for Spring Boot 4

  All versions: affected

• Red Hat · Red Hat build of Apache Camel for Spring Boot 4

  All versions: affected

• Red Hat · Red Hat build of Apache Camel for Spring Boot 4

  All versions: affected

• Red Hat · Red Hat build of Apache Camel for Spring Boot 4

  All versions: affected

• Red Hat · Red Hat Enterprise Linux 10

  All versions: affected

• Red Hat · Red Hat Enterprise Linux 8

  All versions: affected

• Red Hat · Red Hat Enterprise Linux 8

  All versions: affected

• Red Hat · Red Hat Enterprise Linux 9

  All versions: affected

• Red Hat · Red Hat JBoss Enterprise Application Platform 7

  All versions: affected

• Red Hat · Red Hat JBoss Enterprise Application Platform 7

  All versions: affected

• Red Hat · Red Hat JBoss Enterprise Application Platform 7

  All versions: affected

• Red Hat · Red Hat JBoss Enterprise Application Platform 7

  All versions: affected

• Red Hat · Red Hat JBoss Enterprise Application Platform 7

  All versions: affected

• Red Hat · Red Hat JBoss Enterprise Application Platform 7

  All versions: affected

• Red Hat · Red Hat JBoss Enterprise Application Platform 7

  All versions: affected

• Red Hat · Red Hat JBoss Enterprise Application Platform 8

  All versions: affected

• Red Hat · Red Hat JBoss Enterprise Application Platform 8

  All versions: affected

• Red Hat · Red Hat JBoss Enterprise Application Platform 8

  All versions: affected

• Red Hat · Red Hat JBoss Enterprise Application Platform Expansion Pack

  All versions: affected

• Red Hat · Red Hat JBoss Enterprise Application Platform Expansion Pack

  All versions: affected

• Red Hat · Red Hat JBoss Enterprise Application Platform Expansion Pack

  All versions: affected

• Red Hat · Red Hat Single Sign-On 7

  All versions: affected

• Red Hat · Red Hat Single Sign-On 7

  All versions: affected

• Red Hat · Red Hat Single Sign-On 7

  All versions: affected

What to do

Workaround: Applications utilizing Undertow should implement robust input validation and sanitization for all user-controlled data before it is placed into HTTP response headers. It is recommended to restrict header values to printable ASCII characters (0x20–0x7E) at the application level. Where available, use framework-provided header-safe encoding mechanisms to ensure proper handling of special characters.

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2026-58670 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-19879](https://cveledger.app/badge/CVE-2026-19879.svg)](https://cveledger.app/cve/CVE-2026-19879)

Record last updated 5 Nov 2026, 19:26 UTC.