undertow-servlet vulnerabilities

CVEs whose affected-version data names the undertow-servlet package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-114370Low· 3.7

today

Undertow: undertow: pathresourcemanager safepaths check allows sibling-directory symlink traversal

A flaw was found in the PathResourceManager component of the Undertow web server. This component is responsible for serving static files from the file system. The issue occurs because the mechanism used to verify if a symbolic link point…

▾ SunlitRed Hat · undertow-servletvia CVEORG