Undertow

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Separately, for a merged upstream patch : up to $5,000 Google Patch Rewards pays for a patch you get accepted upstream and that stays merged, without reverts, for one month, not for the report. Undertow sits in Tier 2, which caps at $5,000; the $15,000 headline is the Tier 1 column and is not reachable here. Patches must be no more than twelve months old, submissions are rate-limited to three per person per month, and sanctions and territory exclusions apply. CVE history 5 Last 12 months 39 Lifetime Denial of service 35 % Access control 25 % Injection 20 % Info disclosure 15 % Latest advisories Loading the feed Overview Undertow is the HTTP engine inside WildFly and Red Hat JBoss EAP, which together run a large amount of Java enterprise middleware in banking, insurance, telecom and government: usually behind a load balancer, usually holding regulated data, usually several versions behind upstream. Some Spring Boot deployments also pick it over Tomcat as the embedded server. The cost of a bug here is the request-smuggling shape. A desync between the HTTP/1.1, HTTP/2 and AJP front ends rewrites who a request belongs to, landing straight on the authorisation boundary of the application behind it. Red Hat takes reports through product security and pays nothing for them, so sorona.xyz pays you directly on qualified, reproduced findings. In scope The covered object is the Undertow repository itself, reported to Red Hat product security through the process named in the project's SECURITY.md. Everything in that repository is inside the line; WildFly and JBoss EAP subsystems outside it are not The HTTP server end to end: HTTP/1.1 and HTTP/2 request parsing, the connection and framing layers under them, and the request-smuggling surface between the two protocols The AJP connector in full, which is how Undertow sits behind mod_cluster and mod_proxy_ajp in real deployments and which trusts more of its input than HTTP does WebSocket framing and the upgrade handshake The servlet container: path handling, %2f normalisation, the security-constraint matcher and the dispatcher that acts on their result The whole security layer, covering the form-authentication flow and Undertow's native security-context code paths, which decide who a request is running as The handler chain itself, which every request passes through before it reaches an application Out of scope WildFly and JBoss EAP subsystems outside the Undertow repository, which are not covered on this pathway Application-level bugs in servlets deployed on Undertow rather than in the engine itself Java runtime or Netty bugs, which belong to their own upstreams Configuration errors in standalone.xml , which are a deployment matter rather than a defect One-line non-exploitable crash fixes, which sit at the bottom of the reward ladder Patches the maintainers decline, since the reward is contingent on the merge rather than on the idea Most-valued findings Request smuggling or desync between the HTTP/1.1, HTTP/2 and AJP front ends. That parsing surface is historically Undertow's densest CVE area, denial of service and access control are 60% of its bug history, and a desync in front of a JBoss estate rewrites who a request belongs to Security-constraint bypass where the matcher and the dispatcher disagree about a normalised path, which is the class that reaches regulated data behind an enterprise deployment AJP-specific flaws, because the connector is reachable in mod_cluster topologies and is trusted by design in a way the HTTP front end is not Header or request injection that survives the proxy in front of it and reaches the application as a forged, apparently-internal request Structural hardening of the parsers against memory and connection exhaustion, rather than a single limit on a single code path Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. The cash on Google's rail is paid for a merged upstream patch rather than for a vulnerability report; a report on its own earns nothing there Submit the patch to the Undertow maintainers yourself and keep it merged, without reverts, for one month before claiming Patches must be no more than twelve months old when you submit them for reward Three Patch Rewards submissions per person per month is the hard cap The covered object is the Undertow repository itself: WildFly and JBoss EAP subsystems outside it are not covered on this pathway Google cannot pay individuals or entities on sanctions lists, in sanctioned territories, or located in Russia or Belarus Disclosure Coordinated with Red Hat product security through the process named in the project's SECURITY.md; Red Hat assigns the CVE and publishes the advisory but pays nothing for the finding. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability