LiveActive security incident?Get immediate response
CVE Record

CVE-2017-12165: It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual...

It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling.

LowCVSS 2.6Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

This flaw affects Undertow HTTP handling when unusual whitespace appears in request headers. In some deployments it could contribute to HTTP request smuggling, letting a request be interpreted differently across HTTP components. The published severity is low, with limited integrity impact and high attack complexity.

Executive priority

Treat this as routine patch management unless Undertow is internet-facing behind complex proxy chains. It is not KEV-listed in the supplied data, but request smuggling classes can create business risk when combined with front-end/back-end parsing differences.

Technical view

CVE-2017-12165 is CWE-444 in Undertow before the fixed branch releases 1.3.31, 1.4.17, and 2.0.0. The CVSS 3.0 vector is 2.6: network reachable, high complexity, low privileges, user interaction required, no confidentiality or availability impact, and low integrity impact.

Likely exposure

Exposure is most likely in applications or Red Hat-packaged environments using Undertow versions older than the fixed releases cited in the CVE record. Risk depends on whether Undertow sits behind other HTTP intermediaries that parse ambiguous headers differently.

Exploitation context

The source bundle does not show CISA KEV listing or confirmed active exploitation. The flaw is a possible request smuggling condition, but the CVSS vector indicates high complexity and required user interaction, which reduces immediate operational urgency.

Researcher notes

Evidence is limited to the CVE description, CVSS metadata, CWE-444, and Red Hat advisory references. Do not assume exploit availability or broader affected products from this bundle. Focus validation on actual Undertow version lineage and HTTP intermediary behavior.

Mitigation direction

  • Upgrade Undertow to the fixed branch release or a supported later version.
  • Apply the relevant Red Hat security advisory updates for packaged Undertow.
  • Check downstream vendor guidance for products embedding Undertow.
  • Prioritize internet-facing HTTP services and proxy-backed deployments first.

Validation and detection

  • Inventory direct and transitive Undertow versions in deployed applications.
  • Compare deployed versions against 1.3.31, 1.4.17, and 2.0.0 fixed lines.
  • Check Red Hat advisory applicability for managed packages.
  • Review HTTP gateway architecture for ambiguous header parsing paths.
Prepared
Confidence
high
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-444: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2017-12165 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Low
CVSS
2.6 (3.0)
Known Exploited
No
Published

Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
11Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
2.6CVSS 3.0LowCVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N1.21.4Primary CVE score

Vulnerability scoring details

Base CVSS 3.0 score

2.6Low
CVSS 3.0 vector shape for CVE-2017-12165Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Red Hatundertow1.4.17, 1.3.31, 2.0.0Listed
Weakness

CWE details

CWE-444

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-444 · source CWE mapping

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs