What is CVE-2026-19879?
CVE-2026-19879 is a vulnerability in the Undertow HTTP server. The `writeString()` method performs a silent narrowing cast from Unicode to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by crafting specific Unicode characters to manipulate response headers, potentially leading to header injection attacks; Undertow users should apply the update.
Azərbaycanca: CVE-2026-19879 Undertow HTTP serverində zəiflikdir. `writeString()` metodu Unicode simvollarını 8-bit bayta endirərkən səssiz daraltma həyata keçirir. Uzaqdan hücumçu xüsusi Unicode simvollar göndərərək HTTP cavab başlıqlarında manipulyasiya edə bilər, bu da potensial başlıq injection hücumlarına yol açır; Undertow istifadəçiləri yeniləməni tətbiq etməlidir.
FAQ2
Which Undertow function is affected by the CVE-2026-19879 vulnerability?
The vulnerability stems from a silent narrowing cast from Unicode to 8-bit bytes in the Undertow HTTP server's `writeString()` method.
What type of attack can CVE-2026-19879 lead to?
A remote attacker can exploit this flaw by crafting specific Unicode characters to manipulate HTTP response headers, potentially leading to header injection attacks.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.