CVE-2023-4639: undertow HTTP Request/Response Smuggling
Vulnerability summary
CVE-2023-4639 is a high (CVSS 7.4) HTTP Request/Response Smuggling vulnerability in undertow. EPSS estimates a 1.09% chance of exploitation in the next 30 days, higher than 65.1% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 4Timeline
- 17-11-2024PublishedVulnerability first disclosed.
- 07-02-2025Last modifiedVulnerability information updated.
Description
A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · DebianEcosystem advisory · calculated7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · MavenEcosystem advisory · calculated7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- NVDNIST7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS trend
Probability
1.09%
Chance of exploitation in the next 30 days
Percentile
65%
Versus all other CVEs
30-day change
0.00 pp
From 1.09% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- undertow< 2.3.18-1
Io.undertow1 product
- undertow-core≥ 2.3.0.Alpha1, < 2.3.11.Final | < 2.2.30.Final
Ubuntu1 product
- undertowAll versions (No fix recorded)
3 vendors · 3 products
