Hi,

The following vulnerability was published for undertow.

CVE-2026-19879[0]:
| A flaw was found in Undertow, an HTTP server, within its HTTP
| response header writing path. The `writeString()` method performs a
| silent narrowing cast from 16-bit Unicode characters to 8-bit bytes
| when writing HTTP response header values. A remote attacker can
| exploit this by supplying specific Unicode characters in user-
| controlled input that an application places into response headers.
| This can lead to the truncation of these characters into ASCII
| control characters or special symbols, potentially resulting in
| limited integrity impact or information disclosure if the
| application does not properly sanitize user input.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-19879
https://www.cve.org/CVERecord?id=CVE-2026-19879
[1] https://bugzilla.redhat.com/show_bug.cgi?id=2516038

Regards,
Salvatore