Skip to content
Fencer Intel
medium 5.9

CVE-2016-7046 json

Undertow Uncaught Exception vulnerability

published 2016-10-03 10 y ago modified 2026-06-17 4 mo ago also GHSA-3f57-w2rp-72fc , EUVD-2022-2166

cvss
5.9
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.5%
EPSS 2.5% chance of exploitation in 30 days, percentile 84%
public exploits
0
none known

Summary

Red Hat JBoss Enterprise Application Platform (EAP) 7, when operating as a reverse-proxy with default buffer sizes, allows remote attackers to cause a denial of service (CPU and disk consumption) via a long URL.

Patch / fix

  • maven io.undertow:undertow-core 1.3.25.Final, 1.4.3.Final
  • undertow Debian 14 1.4.3-1

debian advisories DEBIAN-CVE-2016-7046

  • eap7-jboss-ec2-eap jboss enterprise application platform 7 7.1.0-5.GA_redhat_5.ep7.el6
  • eap7-jboss-ec2-eap jboss enterprise application platform 7.1 7.1.0-5.GA_redhat_5.ep7.el7
  • eap7-jboss-ec2-eap-samples jboss enterprise application platform 7 7.1.0-5.GA_redhat_5.ep7.el6
  • eap7-jboss-ec2-eap-samples jboss enterprise application platform 7.1 7.1.0-5.GA_redhat_5.ep7.el7
  • eap7-ecj jboss enterprise application platform 7.1 4.6.1-1.redhat_1.1.ep7.el7
  • eap7-vdx jboss enterprise application platform 7.1 1.1.6-1.redhat_1.1.ep7.el7
  • eap7-xom jboss enterprise application platform 7.1 1.2.10-2.redhat_1.1.ep7.el7
  • eap7-txw2 jboss enterprise application platform 7.1 2.2.11-10.redhat_4.1.ep7.el7

red hat advisories RHSA-2017:3458RHSA-2017:3455RHSA-2017:3454RHSA-2016:2642RHSA-2016:2641RHSA-2016:2640

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2016-7046 updated cvss 6.5

undertow: Long URL proxy request lead to java.nio.BufferOverflowException and DoS

  • Red Hat JBoss EAP 7.0
    fixed: vendor fix RHSA-2016:2657
  • Red Hat JBoss EAP 7.1
    fixed: vendor fix RHSA-2017:3456
  • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server eap7-wildfly 7.0.3-4.GA_redhat_2.1.ep7.el6, eap7-jboss-ec2-eap 7.0.3-3.GA_redhat_2.ep7.el6, eap7-undertow 1.3.25-1.Final_redhat_1.1.ep7.el6, eap7-xerces-j2 2.11.0-24.SP5_redhat_1.1.ep7.el6, eap7-hibernate 5.0.11-1.Final_redhat_1.1.ep7.el6, eap7-wildfly-modules 7.0.3-4.GA_redhat_2.1.ep7.el6, +9 more
    fixed: vendor fix RHSA-2016:2640
  • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server eap7-wildfly 7.0.3-4.GA_redhat_2.1.ep7.el7, eap7-jboss-ec2-eap 7.0.3-3.GA_redhat_2.ep7.el7, eap7-undertow 1.3.25-1.Final_redhat_1.1.ep7.el7, eap7-xerces-j2 2.11.0-24.SP5_redhat_1.1.ep7.el7, eap7-hibernate 5.0.11-1.Final_redhat_1.1.ep7.el7, eap7-wildfly-modules 7.0.3-4.GA_redhat_2.1.ep7.el7, +9 more
    fixed: vendor fix RHSA-2016:2642
  • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server eap7-ecj 4.6.1-1.redhat_1.1.ep7.el6, eap7-vdx 1.1.6-1.redhat_1.1.ep7.el6, eap7-xom 1.2.10-2.redhat_1.1.ep7.el6, eap7-jaxen 1.1.6-3.redhat_1.1.ep7.el6, eap7-jsoup 1.8.3-3.redhat_2.1.ep7.el6, eap7-antlr 2.7.7-35.redhat_7.1.ep7.el6, +281 more
    fixed: vendor fix RHSA-2017:3454
  • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server eap7-ecj 4.6.1-1.redhat_1.1.ep7.el7, eap7-vdx 1.1.6-1.redhat_1.1.ep7.el7, eap7-xom 1.2.10-2.redhat_1.1.ep7.el7, eap7-jaxen 1.1.6-3.redhat_1.1.ep7.el7, eap7-jsoup 1.8.3-3.redhat_2.1.ep7.el7, eap7-antlr 2.7.7-35.redhat_7.1.ep7.el7, +281 more
    fixed: vendor fix RHSA-2017:3458

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.48% chance of exploitation in the next 30 days, higher than 84% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.0 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 7.1 AV:N/AC:M/Au:N/C:N/I:N/A:C
GitHub 3.0 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
maven io.undertow:undertow-core
>=1.4.0, <1.4.3.Final
<1.3.25.Final
1.4.3.Final
1.3.25.Final

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.