CVE-2026-19879 is a moderate severity vulnerability in Undertow HTTP server's response header writing path. The flaw involves the writeString() method silently narrowing 16-bit Unicode characters to 8-bit bytes, which can truncate certain Unicode characters into ASCII control characters or special symbols. This may lead to limited integrity impact or information disclosure if user input is not properly sanitized before being placed into HTTP response headers. Undertow prevents HTTP response splitting, but improper validation at the application level can pose risks.