CVE-2026-19879

A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The writeString() method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific Unicode characters in user-controlled input that an application places into response headers. This can lead to the truncation of these characters into ASCII control characters or special symbols, potentially resulting in limited integrity impact or information disclosure if the application does not properly sanitize user input.

This Moderate impact defense-in-depth flaw in Undertow's HTTP response header handling occurs when applications place unsanitized user-controlled Unicode input into response headers. While Undertow prevents HTTP response splitting, the silent truncation of characters to ASCII control characters or special symbols could pose a risk in applications that reflect these header values without proper validation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Applications utilizing Undertow should implement robust input validation and sanitization for all user-controlled data before it is placed into HTTP response headers. It is recommended to restrict header values to printable ASCII characters (0x20–0x7E) at the application level. Where available, use framework-provided header-safe encoding mechanisms to ensure proper handling of special characters.