CVE-2026-19879: Io.undertow/undertow: undertow: http response header integrity issue due to character truncation
A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The writeString() method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific Unicode characters in user-controlled input that an application places into response headers. This can lead to the truncation of these characters into ASCII control characters or special symbols, potentially resulting in limited integrity impact or information disclosure if the application does not properly sanitize user input.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19879?
CVE-2026-19879 has a medium severity rating of 5.3.
How does CVE-2026-19879 affect the Undertow HTTP server?
CVE-2026-19879 affects the Undertow HTTP server by introducing an integrity issue in the HTTP response header writing path.
What kind of attack can be executed using CVE-2026-19879?
A remote attacker can exploit CVE-2026-19879 by supplying specific Unicode characters to manipulate HTTP response headers.
How can I mitigate the risks associated with CVE-2026-19879?
To mitigate the risks of CVE-2026-19879, it is recommended to update to the latest version of the Undertow software.
What is the root cause of the issue in CVE-2026-19879?
The root cause of CVE-2026-19879 is a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes in the writeString() method.