LoginSign Up
← Back to all sparks
U

Undertow

DEVOPS
Velocity0.0

Flexible performant web server written in Java with blocking and non-blocking APIs

undertow.io ↗

Undertow 2.4.0 clears three CVEs and finally lands long-open HTTP/2 and timeout requests

http-serverjavahttp2cve-fixesnio
◆Current state
Undertow's 2.4 line opened in May 2026 with a release that combines three CVE fixes with a backlog of feature requests, several of them years old judging by their issue numbers — in-flight request processing time tracking, comments in the predicate language, a configurable async context timeout replacing a hard-coded one, HTTP/2 GOAWAY connection management, a TLS protocol version exchange attribute, and a method to invalidate all cache paths. The two releases since have been small: a handful of Jiras in 2.4.1, and a 2.4.2 whose entire release note is the sentence that it was tagged.
◆Where it's heading
The 2.4.0 pattern — a long-deferred feature backlog shipping in the same release as security fixes — suggests features move when a release has to happen anyway rather than on their own schedule. What did ship points at operational control: timeouts that were hard-coded becoming configurable, connection lifecycle handling for HTTP/2, and attributes exposing TLS and timing detail to whatever sits above the server. Enabling test runs on JDK 25 in 2.4.1 is the only forward-looking item in the two follow-up releases.
◆Prediction
With three entries and one substantive release among them, there is little to extrapolate from; the JDK 25 test enablement is the one thread that implies more work, pointing at runtime compatibility rather than features as the near-term focus.

◆Recent moves

  1. 1mo ago

    2.4.2.Final

    The release note is one sentence stating the tag was created, with no changelog attached. Nothing about what changed since 2.4.1 is visible from this feed.

    View source ↗
  2. 2mo ago

    Undertow 2.4.1 makes the HTTP/1.1 reason-phrase optional

    Three items: treating the reason-phrase as optional in HTTP/1.1 responses per RFC 9112, enabling tests on JDK 25, and correcting a message id in the new parser's error messages. A small follow-up to the 2.4.0 release published the same day.

    View source ↗
  3. 2mo ago

    Undertow 2.4.0 fixes three CVEs and adds HTTP/2 GOAWAY handling

    The one substantive release in this window, pairing three CVE fixes with a batch of feature requests that had clearly been open a long time. The most useful of them for operators are the configurable async context timeout replacing a hard-coded value, HTTP/2 connection management around GOAWAY frames, and exchange attributes exposing TLS protocol version and in-flight request timing.

    View source ↗