CommandBox 6.3.4 uses Runwar 6.1.7 with Undertow 2.3.24 affected by new CVEs

Communities CommandBox CLI
1

Hi,

During a routine security audit performed by ChatGPT 5.6-sol on a CommandBox 6.3.4 installation, three recently published Undertow HTTP request-smuggling CVEs were identified that affect the Undertow version used by Runwar.

  • CommandBox 6.3.4 selects Runwar Jakarta 6.1.7.
  • Direct inspection of runwar-jakarta-6.1.7.jar shows Implementation-Version: 6.1.7; its embedded Maven metadata identifies undertow-core 2.3.24.Final. The current Runwar dependency file also pins undertowVersion = "2.3.24.Final".
  • Undertow 2.3.24 is affected by CVE-2026-28367, CVE-2026-28368, and CVE-2026-28369.
  • These issues are already fixed in Undertow 2.3.25.Final. Undertow 2.3.26.Final is currently available and could be adopted by Runwar while remaining on the same 2.3.x release line.
  • The strict HTTP parser fixes were backported to Undertow 2.3.x in PR #1963.

Could a new Runwar Jakarta release be published with Undertow 2.3.26.Final and then adopted in a CommandBox update?

References:

COMMANDBOX-1684 covered earlier Undertow and Log4j updates, but not these three CVEs.

Thanks.

2

Yep! Pete Freitag just pointed these out to me last week and I plan to make a release here in a couple days to update to the latest Undertow.