CVE-2019-10212: Potential to access user credentials from the log files when debug logging enabled in io.undertow:undertow-core
Summary
CVE-2019-10212: Potential to access user credentials from the log files when debug logging enabled. Affects io.undertow:undertow-core versions < 2.0.20. Fixed in 2.0.20. How to fix ↓
Also tracked for
- undertow · Debian:13
The same CVE-2019-10212 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
io.undertow:undertow-core is a Maven package that provides core functionality for Undertow, a lightweight web server written in Java. It is commonly used in Java web applications to handle HTTP requests and responses. Undertow DEBUG log for io.undertow.request.security is a feature that logs security-related information during the request processing. However, enabling debug logging can lead to a vulnerability where an attacker can obtain user credentials from the log files.
Vulnerability Detail
The vulnerability (CVE-2019-10212) arises from a flaw in the Undertow DEBUG log for io.undertow.request.security. When debug logging is enabled, an attacker can exploit this flaw to access user credentials stored in the log files. This can have severe consequences as it exposes sensitive information, potentially leading to unauthorized access or identity theft. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Latest published version: 2.4.4.Final as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.0.20
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the fixed version is not immediately possible, a workaround is to disable debug logging for io.undertow.request.security. This can be done by modifying the logging configuration of your application to exclude this specific log category. Below is an example of how to configure logback.xml to disable debug logging for io.undertow.request.security:
<configuration>
<logger name="io.undertow.request.security" level="INFO"/>
</configuration>
Conclusion
In conclusion, the vulnerability (CVE-2019-10212) in io.undertow:undertow-core allows an attacker to access user credentials from the log files when debug logging is enabled. To mitigate this issue, it is crucial to upgrade to version 2.0.20 or above. Alternatively, you can apply a temporary workaround by disabling debug logging for io.undertow.request.security. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for io.undertow:undertow-core →
FAQ
The vulnerability allows an attacker to access user credentials from the log files when debug logging is enabled. This can lead to unauthorized access to user accounts and potential identity theft.
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file of your project.
Yes, upgrading io.undertow:undertow-core to version 2.0.20 or above fixes this vulnerability. It is recommended to update the package in your Maven project and rebuild your application.
Yes, if immediate upgrading is not possible, you can disable debug logging for io.undertow.request.security as a temporary workaround. Modify your application's logging configuration to exclude this log category.
The CVSS score of this vulnerability is 9.8, indicating its critical severity.
Related vulnerabilities
Recent vulnerabilities recorded for io.undertow:undertow-core.
