Description
A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | io.undertow:undertow-core | — | 2.3.5 |
| Red Hat | EAP 7.4.10 release | — | — |
| Red Hat | Red Hat Fuse 7.12 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.1.0 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | — | — |
| Red Hat | Red Hat Single Sign-On 7 | — | — |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 7 | — | — |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 8 | — | — |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 9 | — | — |
| Red Hat | Red Hat support for Spring Boot 2.7.13 | — | — |
| Red Hat | RHEL-8 based Middleware Containers | — | — |
| Red Hat | RHPAM 7.13.1 async | — | — |
| Red Hat | Red Hat build of Quarkus | — | — |
| Red Hat | Red Hat Data Grid 8 | — | — |
| Red Hat | Red Hat Integration Camel K | — | — |
| Red Hat | Red Hat Integration Camel Quarkus | — | — |
| Red Hat | Red Hat Integration Service Registry | — | — |
| Red Hat | Red Hat JBoss Data Grid 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — | — |
| Red Hat | Red Hat JBoss Fuse 6 | — | — |
| Red Hat | Red Hat OpenStack Platform 13 (Queens) | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | undertow | 2.3.8-2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | undertow | No fix yet | — |
| Ubuntu 26.04 LTS | undertow | No fix yet | — |
| Ubuntu 25.10 | undertow | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | undertow | No fix yet | — |
| Ubuntu Pro 22.04 LTS | undertow | No fix yet | — |
| Ubuntu Pro 20.04 LTS | undertow | No fix yet | — |
| Ubuntu Pro 18.04 LTS | undertow | No fix yet | — |
| Ubuntu Pro 16.04 LTS | undertow | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Single Sign On 7 | rh-sso7-keycloak +1 | 18.0.8-1.redhat_00001.1.el7sso | RHSA-2023:3885, RHSA-2023:3884, RHSA-2023:3883 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-activemq-artemis +15 | 1.5.5.016-1.redhat_00001.1.ep7.el7 | RHSA-2025:4226 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-artemis-native +1 | 1:1.5.5.016-1.redhat_00001.1.ep7.el7 | RHSA-2025:4226 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jackson-core +4 | 2.10.4-3.redhat_00006.1.el7eap | RHSA-2025:9583 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jackson-databind +2 | 2.10.4-5.redhat_00006.1.el7eap | RHSA-2025:9583 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jackson-datatype-jdk8 +2 | 2.10.4-2.redhat_00006.1.el7eap | RHSA-2025:9583 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jboss-server-migration +21 | 1.7.2-16.Final_redhat_00017.1.el7eap | RHSA-2025:9583 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jboss-xnio-base | 3.5.11-1.Final_redhat_00001.1.ep7.el7 | RHSA-2025:4226 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jsoup | 1.14.2-1.redhat_00002.1.ep7.el7 | RHSA-2025:4226 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-netty +1 | 4.1.63-5.Final_redhat_00003.1.el7eap | RHSA-2025:9583 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-undertow | 1.4.18-14.SP13_redhat_00001.1.ep7.el7 | RHSA-2025:9583, RHSA-2025:4226 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly +1 | 7.1.10-2.GA_redhat_00002.1.ep7.el7 | RHSA-2025:9583, RHSA-2025:4226 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly-elytron +1 | 1.10.17-1.Final_redhat_00001.1.el7eap | RHSA-2025:9583 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly-javadocs +2 | 7.3.14-3.GA_redhat_00002.1.el7eap | RHSA-2025:9583 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-woodstox-core | 5.0.3-2.redhat_00002.1.ep7.el7 | RHSA-2025:4226 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-xml-security | 2.0.10-2.redhat_00002.1.ep7.el7 | RHSA-2025:4226 |
| Red Hat JBoss EAP 7 | eap7-activemq-artemis-native | 1:1.0.2-3.redhat_00004.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-apache-mime4j | 0.8.9-1.redhat_00001.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-artemis-native +1 | 1:1.0.2-4.redhat_00004.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-artemis-wildfly-integration | 1.0.7-1.redhat_00001.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-infinispan +9 | 11.0.17-1.Final_redhat_00001.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.5.11-1.Final_redhat_00001.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-jboss-ejb-client | 4.0.50-1.Final_redhat_00001.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-jboss-el-api_3.0_spec | 2.0.1-1.Final_redhat_00001.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-jboss-metadata +5 | 13.4.0-1.Final_redhat_00001.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +2 | 1.10.0-26.Final_redhat_00025.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-jbossws-cxf | 5.4.8-1.Final_redhat_00001.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-jbossws-spi | 3.4.0-2.Final_redhat_00001.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-netty +28 | 4.1.86-1.Final_redhat_00001.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-picketlink-api +7 | 2.5.5-22.SP12_redhat_00012.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-resteasy +18 | 3.15.5-1.Final_redhat_00001.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-snakeyaml | 1.33.0-2.SP1_redhat_00001.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.2.22-1.SP3_redhat_00002.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-undertow-jastow | 2.0.14-1.Final_redhat_00001.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-wildfly +4 | 7.4.9-6.GA_redhat_00004.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-wildfly-http-client +4 | 1.1.16-1.Final_redhat_00002.1.el7eap | RHSA-2023:1514, RHSA-2023:1513, RHSA-2023:1512 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk17 | 7.4.10-6.GA_redhat_00002.1.el8eap | RHSA-2023:1514, RHSA-2023:1513 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | io.undertow:undertow-core | >= 2.3.0, < 2.3.5.Final | 2.3.5.Final | GHSA-m4mm-pg93-fv78 |
| Maven | io.undertow:undertow-core | < 2.2.24.Final | 2.2.24.Final | GHSA-m4mm-pg93-fv78 |
Advisories 14
- RHSA-2025:9583 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.14 Security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2025:4226 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.10 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2023:1514 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 9 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:1513 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 8 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:1512 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:3885 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.4 security update on RHEL 9 Red Hat Security Advisories (RHSA) · Oct 2, 2026
- RHSA-2023:3883 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.4 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 2, 2026
- RHSA-2023:3884 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.4 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Oct 2, 2026
- RHSA-2023:1185 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4 security update Red Hat Security Advisories (RHSA) · Oct 2, 2026
- WID-SEC-2023-0611 Red Hat JBoss Enterprise Application Platform: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Oct 29, 2025
- WID-SEC-2025-1459 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 3, 2025
- WID-SEC-2023-1584 Red Hat Single Sign On: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 27, 2025
- WID-SEC-2024-0106 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 16, 2024
- WID-SEC-2023-1755 IBM InfoSphere Information Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 16, 2023
References
- RHSA-2023:1184 vendor-advisory
- RHSA-2023:1185 vendor-advisory
- RHSA-2023:1512 vendor-advisory
- RHSA-2023:1513 vendor-advisory
- RHSA-2023:1514 vendor-advisory
- RHSA-2023:1516 vendor-advisory
- RHSA-2023:2135 vendor-advisory
- RHSA-2023:3883 vendor-advisory
- RHSA-2023:3884 vendor-advisory
- RHSA-2023:3885 vendor-advisory
- RHSA-2023:3888 vendor-advisory
- RHSA-2023:3892 vendor-advisory
- RHSA-2023:3954 vendor-advisory
- RHSA-2023:4612 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2023-1108 vdb-entry
- RHBZ#2174246 issue-tracking
- https://github.com/advisories/GHSA-m4mm-pg93-fv78
- https://security.netapp.com/advisory/ntap-20231020-0002/