CVE-2022-1319

A flaw was found in Undertow. For an AJP 400 response, EAP 7 is improperly sending two response packets, and those packets have the reuse flag set even though JBoss EAP closes the connection. A failure occurs when the connection is reused after a 400 by CPING since it reads in the second SEND_HEADERS response packet instead of a CPONG.

Database specific

{
    "cna_assigner": "redhat",
    "cwe_ids": [
        "CWE-252"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1319.json"
}

References

Affected packages

Git / github.com/undertow-io/undertow

Affected ranges

Type

GIT

Repo

https://github.com/undertow-io/undertow

Events

Introduced

Fixed

83a40d3b6a722709fbbccc7f0ff326607fcbd11c

Introduced

83a40d3b6a722709fbbccc7f0ff326607fcbd11c

Fixed

1443a1a2bbb8e32e56788109d8285db250d55c8b

Fixed

7c5b3ab885b5638fd3f1e8a935d5063d68aa2df3

Database specific

Show details

{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "2.2.17"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:redhat:undertow:2.2.17:-:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "2.2.17-NA"
                },
                {
                    "last_affected": "2.2.17-NA"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:redhat:undertow:2.2.19:-:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "2.2.19-NA"
                },
                {
                    "last_affected": "2.2.19-NA"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpe": "cpe:2.3:a:redhat:undertow:2.3.0:alpha1:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "2.3.0-alpha1"
                },
                {
                    "last_affected": "2.3.0-alpha1"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "range": [
                {
                    "fixed": "1443a1a2bbb8e32e56788109d8285db250d55c8b"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "7c5b3ab885b5638fd3f1e8a935d5063d68aa2df3"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

1.*

1.0.0.Alpha1

1.0.0.Alpha10

1.0.0.Alpha11

1.0.0.Alpha12

1.0.0.Alpha13

1.0.0.Alpha14

1.0.0.Alpha15

1.0.0.Alpha16

1.0.0.Alpha17

1.0.0.Alpha18

1.0.0.Alpha19

1.0.0.Alpha2

1.0.0.Alpha20

1.0.0.Alpha21

1.0.0.Alpha22

1.0.0.Alpha3

1.0.0.Alpha4

1.0.0.Alpha5

1.0.0.Alpha6

1.0.0.Alpha7

1.0.0.Alpha8

1.0.0.Alpha9

1.0.0.Beta1

1.0.0.Beta10

1.0.0.Beta11

1.0.0.Beta12

1.0.0.Beta13

1.0.0.Beta14

1.0.0.Beta15

1.0.0.Beta16

1.0.0.Beta17

1.0.0.Beta18

1.0.0.Beta19

1.0.0.Beta2

1.0.0.Beta20

1.0.0.Beta21

1.0.0.Beta22

1.0.0.Beta23

1.0.0.Beta24

1.0.0.Beta25

1.0.0.Beta26

1.0.0.Beta27

1.0.0.Beta28

1.0.0.Beta29

1.0.0.Beta3

1.0.0.Beta30

1.0.0.Beta31

1.0.0.Beta32

1.0.0.Beta33

1.0.0.Beta4

1.0.0.Beta5

1.0.0.Beta6

1.0.0.Beta7

1.0.0.Beta8

1.0.0.Beta9

1.0.0.CR1

1.0.0.CR2

1.0.0.CR3

1.0.0.CR4

1.0.0.Final

1.0.1.Final

1.0.2.Final

1.0.3.Final

1.1.0.Beta1

1.1.0.Beta2

1.1.0.Beta3

1.1.0.Beta4

1.1.0.Beta5

1.1.0.Beta6

1.1.0.Beta7

1.1.0.Beta8

1.2.0.Beta1

1.2.0.Beta10

1.2.0.Beta2

1.2.0.Beta3

1.2.0.Beta4

1.2.0.Beta5

1.2.0.Beta6

1.2.0.Beta7

1.2.0.Beta8

1.2.0.Beta9

1.2.0.CR1

1.2.0.Final

1.2.1.Final

1.2.2.Final

1.2.3.Final

1.2.4.Final

1.3.0.Beta1

1.3.0.Beta10

1.3.0.Beta11

1.3.0.Beta12

1.3.0.Beta13

1.3.0.Beta2

1.3.0.Beta3

1.3.0.Beta4

1.3.0.Beta5

1.3.0.Beta6

1.3.0.Beta7

1.3.0.Beta8

1.3.0.Beta9

1.3.0.CR1

1.3.0.CR2

1.3.0.CR3

1.3.0.Final

1.3.1.Final

1.3.2.Final

1.3.3.Final

2.*

2.0.0.Alpha1

2.0.0.Beta1

2.0.0.Final

2.0.1.Final

2.0.10.Final

2.0.11.Final

2.0.12.Final

2.0.13.Final

2.0.14.Final

2.0.15.Final

2.0.16.Final

2.0.17.Final

2.0.2.Final

2.0.20.Final

2.0.21.Final

2.0.22.Final

2.0.23.Final

2.0.24.Final

2.0.25.Final

2.0.26.Final

2.0.27.Final

2.0.28.Final

2.0.29.Final

2.0.3.Final

2.0.4.Final

2.0.5.Final

2.0.6.Final

2.0.7.Final

2.0.8.Final

2.0.9.Final

2.1.0.Final

2.1.1.Final

2.1.2.Final

2.1.3.Final

2.1.4.Final

2.2.0.Final

2.2.1.Final

2.2.10.Final

2.2.11.Final

2.2.12.Final

2.2.13.Final

2.2.14.Final

2.2.15.Final

2.2.16.Final

2.2.17-NA

2.2.19-NA

2.2.2.Final

2.2.3.Final

2.2.4.Final

2.2.5.Final

2.2.6.Final

2.2.7.Final

2.2.8.Final

2.2.9.Final

2.3.0-alpha1

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-1319.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "326280464589427992575735744524297913233",
                "114197148306807790186374633251240399393",
                "157826366970093142056232081588463454150",
                "124160317417894610465899165539382148470",
                "193703900915413689060034964461335143365",
                "174416569823837933819691547902972590876",
                "205907144551855956498827172647116652313",
                "298264564201812733016405914443669288133"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2022-1319-1249844a",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/undertow-io/undertow/commit/1443a1a2bbb8e32e56788109d8285db250d55c8b",
        "target": {
            "file": "core/src/main/java/io/undertow/server/protocol/ajp/AjpReadListener.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "203608761728171268144996550627621916480",
            "length": 4166
        },
        "id": "CVE-2022-1319-6199bdcb",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/undertow-io/undertow/commit/1443a1a2bbb8e32e56788109d8285db250d55c8b",
        "target": {
            "file": "core/src/main/java/io/undertow/server/protocol/ajp/AjpReadListener.java",
            "function": "handleEvent"
        }
    }
]

vanir_signatures_modified

"2026-10-20T07:21:17Z"