Release 2.3.21.Final fixes CVE-2024-3884 CVE-2024-4027 CVE-2025-12543
Full list of Jiras: view in Jira
Release Notes - Undertow - Version 2.3.21.Final
Sub-task
- [UNDERTOW-2490] - Improve the documentation of UndertowOptions.HTTP_HEADERS_CACHE_SIZE / DEFAULT_HTTP_HEADERS_CACHE_SIZE
Feature Request
- [UNDERTOW-2580] - Support SameSite and custom cookie attributes
Bug
- [UNDERTOW-1359] - HTTP2 - java.lang.IllegalStateException: UT000091: Buffer has already been freed
- [UNDERTOW-1561] - ServletContext.getResourcePaths() omits Resources that are not available directly on the file system
- [UNDERTOW-2157] - UndertowOutputStream.transferFrom appears to have a broken signature
- [UNDERTOW-2165] - READ_TIMEOUT is not taken into account in HTTP2 listener
- [UNDERTOW-2269] - Encode Query string on forward/include and properly handle merging
- [UNDERTOW-2377] - CVE-2024-3884 CVE-2024-4027 OutOfMemory when parsing form data encoding with application/x-www-form-urlencoded
- [UNDERTOW-2421] - ServletSessionConfig is missing support for arbitrary cookie attributes
- [UNDERTOW-2534] - ClassLoader of deployed websockets application leaks to XnioWorker
- [UNDERTOW-2582] - ServerWebSocketContainer keeps reference to CLs
- [UNDERTOW-2591] - SSEHandler header Connection is set to close
- [UNDERTOW-2605] - FixedLengthStreamSourceConduit does not clean up ReadTimeoutStreamSourceConduit after an exact Content-Length read
- [UNDERTOW-2609] - Previous fixes in the handling of decoded characters in query requests reflect in getQueryString of APIs
- [UNDERTOW-2656] - CVE-2025-12543 Undertow HTTP Server Fails to Reject Malformed Host Headers Leading to Potential Cache Poisoning and SSRF
- [UNDERTOW-2662] - Quoted cookie versions cannot be parsed correctly
- [UNDERTOW-2668] - ServletRelativePathAttribute switch to %U from %R and return absolute path
- [UNDERTOW-2674] - Wrong codes sent on WebSocket connection close
- [UNDERTOW-2675] - Make Undertow compatible with RFC6265
Task
- [UNDERTOW-2103] - Enable open ssl building in CI
- [UNDERTOW-2653] - Add back servlets and websockets-jsr to Ci
Component Upgrade
- [UNDERTOW-2644] - Upgrade wildfly openssl to 2.2.5.Final
Enhancement
- [UNDERTOW-2231] - Test Flakiness occurs for io.undertow.server.handlers.proxy.LoadBalancingProxyTestCase#testLoadSharedWithServerShutdown
- [UNDERTOW-2638] - Process all buffers in ChunkedStreamSinkConduit.write(ByteBuffer[], int, int)
- [UNDERTOW-2643] - At ServletOutputStreamImpl.close remove the conversion of int to String