CVE-2017-2666

MEDIUM

Undertow < 1.3.31 - HTTP Request Smuggling via Invalid Request Line Characters

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 3 public exploits for CVE-2017-2666. PoCs published by dawetmaster, andikahilmy, tafamace.

AI-analyzed exploit summary The repository contains only the source code of Undertow, a Java web server, without any exploit code or technical analysis related to CVE-2017-2666. The README provides no details about the vulnerability or how to exploit it.

Description

It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other than their own.

Exploits (3)

nomisec STUB
by dawetmaster · poc
https://github.com/dawetmaster/CVE-2017-2666-undertow-vulnerable

The repository contains only the source code of Undertow, a Java web server, without any exploit code or technical analysis related to CVE-2017-2666. The README provides no details about the vulnerability or how to exploit it.

Classification
Stub 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: Undertow (version not specified)
No auth needed
Prerequisites: none
devstral-2 · analyzed Mar 14, 2026 Full analysis →
nomisec STUB
by andikahilmy · poc
https://github.com/andikahilmy/CVE-2017-2666-undertow-vulnerable

The repository contains only the source code of Undertow, a Java web server, without any exploit code or technical analysis related to CVE-2017-2666. The README provides no details about the vulnerability or how to exploit it.

Classification
Stub 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: Undertow (version not specified)
No auth needed
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec STUB
by tafamace · poc
https://github.com/tafamace/CVE-2017-2666

The provided code is a simple Java stub that prints command-line arguments and does not demonstrate any exploit functionality. It lacks any offensive techniques or vulnerability-specific logic.

Classification
Stub 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: N/A
No auth needed
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (11)

Core 11
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2017:1411
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2017-1409.html
Issue Tracking, Vendor Advisory x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2666
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2017/dsa-3906
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2017:3458
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2017:1410
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2017:1412
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2017:3455
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2017:3456
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/98966
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2017:3454

Scores

CVSS v3 6.5
EPSS 0.0139
EPSS Percentile 80.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Details

CWE
CWE-444
Status published
Products (6)
debian/debian_linux 9.0
debian/debian_linux 10.0
io.undertow/undertow-core 0 - 1.3.31Maven
redhat/jboss_enterprise_application_platform 7.0.0
redhat/jboss_enterprise_application_platform 7.1.0
redhat/undertow
Published Jul 27, 2018
Tracked Since Feb 18, 2026