CVE-2016-4993: CRLF Injection Vulnerability in WildFly Undertow
Summary
CVE-2016-4993: Improper Neutralization of CRLF Sequences in Wildfly Undertow. Affects org.wildfly:wildfly-undertow versions >= 10.0.0.Final, < 11.0.0.Final. Fixed in 11.0.0.Final. How to fix ↓
Also tracked for
- undertow · Debian:13
The same CVE-2016-4993 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
WildFly Undertow is a web server component used in Red Hat JBoss Enterprise Application Platform (EAP) 7.x. It provides a lightweight and high-performance web server for Java applications. The vulnerability identified as CVE-2016-4993 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks. This vulnerability affects WildFly 10.0.0 and earlier versions.
Vulnerability Detail
The CRLF injection vulnerability in WildFly Undertow allows attackers to manipulate HTTP headers and perform HTTP response splitting attacks. By injecting CRLF sequences, attackers can insert arbitrary headers into the response, potentially leading to various security issues such as cross-site scripting (XSS) attacks, cache poisoning, and session hijacking. This vulnerability can be exploited remotely, posing a significant risk to applications using affected versions of WildFly Undertow.
How To Fix
Latest published version: 42.0.0.Final as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
11.0.0.Final
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by sanitizing user input and validating HTTP headers. Ensure that user-supplied data is properly encoded and does not contain any CRLF sequences. Additionally, consider implementing a web application firewall (WAF) to detect and block malicious requests attempting to exploit this vulnerability.
Conclusion
The CRLF injection vulnerability in WildFly Undertow poses a significant risk to applications using affected versions. It allows attackers to manipulate HTTP headers and conduct various attacks. To mitigate this vulnerability, it is crucial to upgrade to the latest version of WildFly Undertow and implement proper input sanitization and validation. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.wildfly:wildfly-undertow →
FAQ
The CRLF injection vulnerability in WildFly Undertow can lead to various security issues, including cross-site scripting (XSS) attacks, cache poisoning, and session hijacking. Attackers can manipulate HTTP headers and inject arbitrary content into responses, potentially compromising the integrity and security of the application.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file of your application.
Yes, the CVSS score for this vulnerability is 6.1, indicating a moderate severity level.
A temporary workaround is to sanitize user input and validate HTTP headers to prevent CRLF injection. Additionally, implementing a web application firewall (WAF) can help detect and block malicious requests attempting to exploit this vulnerability.
The recommended solution is to upgrade to WildFly Undertow version 11.0.0 or later. This version includes the necessary patches and security enhancements to mitigate the CRLF injection vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for org.wildfly:wildfly-undertow.
