{"action":"Upgrade undertow to 1.4.23-1 or later.","affected":[{"fixed":"1.4.23-1","introduced":"0"}],"component":"undertow","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":["1.4.23-1"],"id":"tcs_01M5NCM4QNC0TWH5DR1AC60F8N","modified_at":"2026-09-01T20:03:50.071925285Z","published_at":"2018-01-10T15:29:00.317Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2017-7559","https://security-tracker.debian.org/tracker/CVE-2017-7559"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2017-7559","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2017-7559"}],"summary":"In Undertow 2.x before 2.0.0.Alpha2, 1.4.x before 1.4.17.Final, and 1.3.x before 1.3.31.Final, it was found that the fix for CVE-2017-2666 was incomplete and invalid characters are still allowed in th"}