CVE-2020-1757: Improper Input Validation in Undertow
Summary
CVE-2020-1757: Improper Input Validation in Undertow. Affects io.undertow:undertow-core versions < 2.1.0. Fixed in 2.1.0. How to fix ↓
Also tracked for
- undertow · Debian:13
The same CVE-2020-1757 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Undertow is a lightweight web server and servlet container designed for high performance and scalability. It is widely used in Java-based web applications. This vulnerability affects all versions of undertow-2.x.x SP1 prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final. The vulnerability arises from the Servlet container incorrectly normalizing the servletPath by truncating the path after a semicolon. This can lead to an application mapping resulting in a security bypass.
Vulnerability Detail
The vulnerability in Undertow arises from improper input validation in the Servlet container. When processing the servletPath, the container incorrectly truncates the path after a semicolon. This can result in an incorrect application mapping, potentially bypassing security measures. The vulnerability has a CVSS score of 8.1, indicating a high severity level. Exploitation of this vulnerability could lead to unauthorized access, data breaches, or other security compromises.
How To Fix
Latest published version: 2.4.4.Final as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.1.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended approach is to upgrade to the fixed version of Undertow as mentioned in the 'how_to_fix' section.
Conclusion
The vulnerability in Undertow (CVE-2020-1757) is a high-severity issue that can result in a security bypass. It is crucial to upgrade to the fixed version of Undertow (2.1.0.Final or later) and regularly update all project dependencies to mitigate the risk of known vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.undertow:undertow-core →
FAQ
Undertow is a lightweight web server and servlet container designed for high performance and scalability. It is commonly used in Java-based web applications.
All undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final are affected by this vulnerability.
The vulnerability can lead to a security bypass, potentially allowing unauthorized access, data breaches, or other security compromises.
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
To fix this vulnerability, it is recommended to upgrade to undertow-2.1.0.Final or later. Update your project dependencies to use the fixed version of the 'io.undertow:undertow-core' package.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.undertow:undertow-core.
