[Git][security-tracker-team/security-tracker][master] new undertow issues

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
f259abc7 by Moritz Muehlenhoff at 2026-08-12T16:51:26+02:00
new undertow issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -2057,13 +2057,15 @@ CVE-2026-17061 (A Deserialization of Untrusted Data vulnerability affecting SIMU
 CVE-2026-15567 (A flaw was found in Wildfly. A remote unauthenticated attacker can tri ...)
 	- wildfly <itp> (bug #752018)
 CVE-2026-15565 (A flaw was found in Undertow. A remote attacker can cause Out of Memor ...)
-	TODO: check
+	- undertow <unfixed>
+	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2490628
 CVE-2026-15563 (A flaw was found in EAP's IIOP. The listener's NameService would accep ...)
 	NOT-FOR-US: Red Hat JBoss Enterprise Application Platform
 CVE-2026-15562 (A flaw was found in EAP's jboss-remoting. A remote unauthenticated att ...)
 	NOT-FOR-US: Red Hat JBoss Enterprise Application Platform
 CVE-2026-15561 (A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder.  ...)
-	TODO: check
+	- undertow <unfixed>
+	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2483133
 CVE-2026-15560 (when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attack ...)
 	NOT-FOR-US: Red Hat JBoss Enterprise Application Platform
 CVE-2026-15556 (A flaw was found in Picketlink's SP signature validation; a SAML respo ...)
@@ -2071,11 +2073,13 @@ CVE-2026-15556 (A flaw was found in Picketlink's SP signature validation; a SAML
 CVE-2026-15555 (A flaw was found in JBoss marshalling. The Infinispan session replicat ...)
 	NOT-FOR-US: Red Hat JBoss Enterprise Application Platform
 CVE-2026-15554 (the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attri ...)
-	TODO: check
+	- undertow <unfixed>
+	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2480601
 CVE-2026-15426 (The AcyMailing \u2013 An Ultimate Newsletter Plugin and Marketing Auto ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-14180 (A flaw was found in the ChunkReader component of the Undertow HTTP ser ...)
-	TODO: check
+	- undertow <unfixed>
+	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2494771
 CVE-2026-13739 (A legacy endpoint in Command Center contained an unauthenticated serve ...)
 	NOT-FOR-US: Commvault
 CVE-2026-13738 (CommServe contained an authorization bypass vulnerability affecting a  ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f259abc7b9a940072b0c5b8331b38b6f25f8cceb

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f259abc7b9a940072b0c5b8331b38b6f25f8cceb
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260812/df3e7081/attachment.htm>