CVE-2022-1319

    Dashboard / Vulnerabilities / CVE-2022-1319

    CVE-2022-1319

    Published: 31 Aug 2022Last Modified: 12 Aug 2026

    Summary:

    Details: A flaw was found in Undertow. For an AJP 400 response, EAP 7 is improperly sending two response packets, and those packets have the reuse flag set even though JBoss EAP closes the connection. A failure occurs when the connection is reused after a 400 by CPING since it reads in the second SEND_HEADERS response packet instead of a CPONG.

    References: https://access.redhat.com/security/cve/CVE-2022-1319, https://issues.redhat.com/browse/UNDERTOW-2060, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1319.json, https://nvd.nist.gov/vuln/detail/CVE-2022-1319, https://security.netapp.com/advisory/ntap-20221014-0006/, https://bugzilla.redhat.com/show_bug.cgi?id=2073890, https://github.com/undertow-io/undertow/commit/1443a1a2bbb8e32e56788109d8285db250d55c8b, https://github.com/undertow-io/undertow/commit/7c5b3ab885b5638fd3f1e8a935d5063d68aa2df3

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -83a40d3b6a722709fbbccc7f0ff326607fcbd11c

    Affected versions

    2.2.17-NA
    2.2.19-NA
    2.2.17.Final
    2.2.16.Final
    2.2.15.Final
    2.2.14.Final
    2.2.13.Final
    2.2.12.Final
    2.2.11.Final
    2.2.10.Final
    2.2.9.Final
    2.2.8.Final
    2.2.7.Final
    2.2.6.Final
    2.2.5.Final
    2.2.3.Final
    2.2.4.Final
    2.2.2.Final
    2.2.1.Final
    2.2.0.Final

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-1319 | CVE-DB