3.7
Low
CVE-2026-114370 A flaw was found in the PathResourceManager component of the Undertow web server
Description
A flaw was found in the PathResourceManager component of the Undertow web server. This component is responsible for serving static files from the file system. The issue occurs because the mechanism used to verify if a symbolic link points to a safe location only checks if the target path starts with a specific string, without ensuring it matches a full directory name. This could allow an attacker to access files in a sibling directory if that directorys name starts with the same characters as an authorized safe directory.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat build of Apache Camel for Spring Boot 4 | Versions not published | |
| Red Hat Enterprise Linux 8 | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat Fuse 7 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform 7 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform 8 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Versions not published | |
| Red Hat Single Sign-On 7 | Versions not published |
References
- access.redhat.com access.redhat.com
- RHBZ#2528757 bugzilla.redhat.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat build of Apache Camel for Spring Boot 4
The 106 CVEs of Red Hat build of Apache Camel for Spring Boot 4 →
CVE-2026-91920
Undertow: undertow: chunkreader message length permits chunk-size overflow
6.5
Medium
CVE-2026-93562
A flaw was found in Netty's HTTP/1 decoder
6.5
Medium
CVE-2026-93574
A flaw was found in Netty's `netty-codec-http` component
6.5
Medium
CVE-2026-93579
Io.netty/netty-codec-http2: netty: http/2 header field values are not validated by default (cr/lf/nul passthrough)
6.5
Medium