Update dependency io.undertow:undertow-core to v2.3.18.Final

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
io.undertow:undertow-core (source)	2.3.1.Final -> 2.3.18.Final

---

Release Notes

undertow-io/undertow (io.undertow:undertow-core)

v2.3.18.Final

Compare Source

v2.3.17.Final

Compare Source

Includes CVEs: CVE-2024-7885

    Release Notes - Undertow - Version 2.3.17.Final
                                                    

Bug

• [UNDERTOW-2429] - CVE-2024-7885 undertow: Improper State Management in Proxy Protocol parsing causes information leakage

v2.3.16.Final

Compare Source

Release Notes - Undertow - Version 2.3.16.Final

Bug

• [UNDERTOW-2256] - Resource predicate presentation differs depending on how it is set up
• [UNDERTOW-2312] - multibytes language in URL request to http/https are broken in EAP access log.
• [UNDERTOW-2381] - Invalid/benevolent hpack decoding of huffman-encoded string literal with EOS symbol
• [UNDERTOW-2424] - Undertow produces malformed Http/1.1 responses under heavy concurrent load
• [UNDERTOW-2425] - io.undertow.servlet.spec.ServletPrintWriter.close() high CPU when encoding characters on previously errored writer

v2.3.15.Final

Compare Source

v2.3.14.Final

Compare Source

Includes CVES: CVE-2024-6162 CVE-2024-27316 CVE-2023-5685

    Release Notes - Undertow - Version 2.3.14.Final
    

Sub-task

• [UNDERTOW-2400] - ResponseWriterTestCase fails because ServletinputStream is closed before read

Bug

• [UNDERTOW-2332] - CachingResource mishandling with TTL =0 and FS exhaustion
• [UNDERTOW-2334] - CVE-2024-6162 url-encoded request path information can be broken on ajp-listener
• [UNDERTOW-2378] - Adjust properly session timeout also in case when custom auth mechanisms are used
• [UNDERTOW-2383] - Canonicalized query string in redirect location can break included links
• [UNDERTOW-2385] - Memory leak in ThreadLocalCache
• [UNDERTOW-2389] - DefaultByteBufferPool leaks buffers for released threads
• [UNDERTOW-2405] - CVE-2024-27316 HTTP-2: httpd: CONTINUATION frames DoS
• [UNDERTOW-2407] - NullPointerException on DefaultByteBufferPool.close
• [UNDERTOW-2409] - Adjust properly session timeout also in case when GET requests with custom auth mechanisms are used

Component Upgrade

• [UNDERTOW-2391] - CVE-2023-5685 Upgrade XNIO to 3.8.16.Final

Enhancement

• [UNDERTOW-2408] - Make fields final in DefaultByteBufferPool when appliable

v2.3.13.Final

Compare Source

v2.3.12.Final

Compare Source

v2.3.11.Final

Compare Source

v2.3.10.Final

Compare Source

v2.3.9.Final

Compare Source

v2.3.8.Final

Compare Source

v2.3.7.Final

Compare Source

v2.3.6.Final

Compare Source

v2.3.5.Final

Compare Source

v2.3.4.Final

Compare Source

v2.3.3.Final

Compare Source

v2.3.2.Final

Compare Source

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.