CVE-2017-2666: It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters.

Security readout for executives and security teams

Undertow accepted invalid characters in HTTP request lines. If a front proxy accepted the same malformed traffic but interpreted it differently, an attacker could manipulate responses. Business impact is web-cache poisoning, cross-site scripting, or exposure of another user’s request data. Severity is moderate because exploitation is network-reachable but depends on proxy behavior. Exposure is most likely where Undertow-backed applications sit behind a proxy or cache that permits invalid request-line characters and parses them differently. Products or versions beyond “undertow” are not specified in the provided CVE data. Treat this as a moderate-priority hygiene and exposure-reduction issue. It is not listed as actively exploited, but proxy/application parsing gaps can affect customer trust by enabling content injection or cross-user data leakage. Mitigation focus: Identify internet-facing and internal applications using Undertow behind proxies or web caches.; Review Red Hat, Debian, or other vendor advisories for applicable Undertow package updates.; Apply vendor-supported fixes for affected distributions and application platforms..

Prepared

May 24, 2026, 20:29 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.