Description

A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The `writeString()` method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific Unicode characters in user-controlled input that an application places into response headers. This can lead to the truncation of these characters into ASCII control characters or special symbols, potentially resulting in limited integrity impact or information disclosure if the application does not properly sanitize user input.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-14T15:17:09.310Z",
  "pubdate": "2026-08-14T15:17:09.310Z",
  "executiveSummary": "A vulnerability has been identified in the Undertow HTTP server relating to its HTTP response header writing mechanisms. Specifically, the flaw exists within the writeString() method, which performs an unsafe and silent narrowing cast that truncates 16-bit Unicode characters down to 8-bit bytes when serializing HTTP response header values. This behavior allows remote attackers to supply maliciously crafted Unicode characters via user-controlled input sources that are subsequently reflected within application-generated HTTP response headers.\nThe primary risk implications of this vulnerability include limited integrity impacts and potential information disclosure. By leveraging this truncation flaw, an attacker can manipulate header values to transform specific Unicode inputs into unintended ASCII control characters or special symbols. Successful exploitation requires an application to accept user-controlled input and improperly place it directly into response headers without prior sanitization or validation. The vulnerability is network-exploitable and grants attackers the ability to influence HTTP response header formatting through specially crafted payloads.",
  "technicalDetails": "The vulnerability resides in the HTTP response header writing path of the Undertow HTTP server, specifically within the writeString() function. The root cause of the flaw is an implicit and silent narrowing type conversion where 16-bit Unicode characters are cast into 8-bit bytes during the serialization of HTTP response header values. Because the operation drops the upper byte of the 16-bit characters, high-value Unicode code points are effectively truncated.\nThe attack flow proceeds as follows: First, a remote, unauthenticated attacker supplies specific, user-controlled input containing targeted Unicode characters to an application running on the vulnerable Undertow server. Second, the application processes this input and improperly integrates it directly into HTTP response headers via the vulnerable writeString() method without implementing adequate input sanitization, encoding validation, or output filtering. Third, during the header writing phase, the Undertow server executes the silent narrowing cast on the provided string. Finally, the truncation converts the sophisticated Unicode characters into specific ASCII control characters, delimiters, or special symbols.\nThis payload behavior alters the structural integrity of the HTTP response headers. Depending on the application context and the resulting control characters, this manipulation can lead to limited integrity impacts, header injection artifacts, or potential information disclosure vectors. The vulnerability is exposed over the network, does not require prior authentication or elevated privileges, and relies entirely on the application's handling of user-supplied data destined for response headers."
}