in depth analysis: https://docs.google.com/document/d/1XdX8AJzGjBgCLE0UZ5NRGGrzQ14HSVS8HcDgH0X70w/edit?tab=t.d440c4doqxdr#bookmark=kix.axzzwc7bbq6o
An external security assessment of Red Hat JBoss EAP 7 identified that the Undertow AJP listener on default port 8009 honours forged sslcert and isssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP protocol.
A flaw was found in Jastow. Jastow is vulnerable to Cross-Site Scripting (XSS) attack. If using a set of combined configuration to allow unescaped characters in URL with embedded Undertow and Jastow, a server might be vulnerable to improper input handling.
The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and in http/2. I would add it to any TLS client protocol. https://issues.redhat.com/browse/UNDERTOW-2212
A flaw was found in Undertow where a potential security issue in flow control handling by browser over HTTP/2 may potentially cause overhead or DOS in the server. The highest impact of this vulnerability is availability.(incomplete fix for CVE-2021-3629)
A vulnerability was found in Undertow where buffer leak on incoming websocket PONG message may lead to memory exhaustion.
https://issues.redhat.com/browse/UNDERTOW-1935
It was found that the AJP connector in undertow does not use the ALLOWENCODEDSLASH option and thus allow the the slash / anti-slash characters encoded in the url which may lead to path traversal and result in the information disclosure of arbitrary local files.
Undertow keeps a cache of seen HTTP headers in persistent connections. It was found that this cache can easily exploited to fill memory with garbage, up to "max-headers" (default 200) "max-header-size" (default 1MB) per active TCP connection.
Upstream bug:
https://issues.jboss.org/browse/WFLY-7725