Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

undertow-io/undertow

              main @ c8299de
            

Fixes

CVEs

CRITICAL

Peak severity

58.3%

Coverage

Highlights

Denial of Service: 7 prior fixes. Scrutinize any change in this area.

core/src/main/java/io/undertow/protocols/http2/Http2Channel.java: most-fixed (2 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

HTTP Request Smuggling: Inconsistent or permissive parsing of HTTP header structures and terminators has historically allowed request smuggling, web cache poisoning, and security bypasses across proxies. Strict RFC enforcement is vital.

Use After Free: Manual memory deallocation of off-heap buffers is prone to race conditions, leading to premature buffer destruction while active threads still hold references. This requires a robust, delayed, or thread-safe deallocation queue.

Denial of Service: HTTP/2 protocol complexity allows client-induced resource exhaustion. Past vulnerabilities involved infinite stream-reset loops, unthrottled outbound RST_STREAM frame rates, and excessive state retention for closed streams.