CVE-2026-19879

Name of the Vulnerable Software and Affected Versions Undertow (affected versions not specified)

Description A flaw exists in the HTTP response header writing path of the Undertow HTTP server. The writeString() function performs a silent narrowing cast, converting 16-bit Unicode characters to 8-bit bytes when writing response header values. A remote attacker can exploit this by providing specific Unicode characters via user-controlled input that the application includes in response headers. This process can truncate characters into ASCII control characters or special symbols, which may lead to information disclosure or limited integrity impact if user input is not properly sanitized.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.