Description
A vulnerability was found in Undertow. This issue requires enabling the learning-push handler in the server's config, which is disabled by default, leaving the maxAge config in the handler unconfigured. The default is -1, which makes the handler vulnerable. If someone overwrites that config, the server is not subject to the attack. The attacker needs to be able to reach the server with a normal HTTP request.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | undertow | ≤ 2.3.14.Final | — |
| Red Hat | Red Hat build of Quarkus 3.8.6.redhat | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | — | — |
| Red Hat | OpenShift Serverless | — | — |
| Red Hat | Red Hat build of Apache Camel 4 for Quarkus 3 | — | — |
| Red Hat | Red Hat build of Apache Camel for Spring Boot 4 | — | — |
| Red Hat | Red Hat build of Apache Camel - HawtIO 4 | — | — |
| Red Hat | Red Hat build of Apicurio Registry 2 | — | — |
| Red Hat | Red Hat Build of Keycloak | — | — |
| Red Hat | Red Hat build of OptaPlanner 8 | — | — |
| Red Hat | Red Hat build of Quarkus | — | — |
| Red Hat | Red Hat Data Grid 8 | — | — |
| Red Hat | Red Hat Fuse 7 | — | — |
| Red Hat | Red Hat Integration Camel K 1 | — | — |
| Red Hat | Red Hat Integration Camel Quarkus 2 | — | — |
| Red Hat | Red Hat JBoss Data Grid 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — | — |
| Red Hat | Red Hat JBoss Fuse Service Works 6 | — | — |
| Red Hat | Red Hat Process Automation 7 | — | — |
| Red Hat | Red Hat Single Sign-On 7 | — | — |
| Red Hat | streams for Apache Kafka | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | undertow | 2.3.18-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | undertow | No fix yet | — |
| Ubuntu 26.04 LTS | undertow | No fix yet | — |
| Ubuntu 25.10 | undertow | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | undertow | No fix yet | — |
| Ubuntu Pro 22.04 LTS | undertow | No fix yet | — |
| Ubuntu Pro 20.04 LTS | undertow | No fix yet | — |
| Ubuntu Pro 18.04 LTS | undertow | No fix yet | — |
| Ubuntu Pro 16.04 LTS | undertow | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 7 | eap7-bouncycastle +5 | 1.78.1-1.redhat_00002.1.el7eap | RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.3.23-1.Final_redhat_00001.1.el7eap | RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.5.17-1.Final_redhat_00001.1.el7eap | RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143 |
| Red Hat JBoss EAP 7 | eap7-jandex | 2.4.5-1.Final_redhat_00001.1.el7eap | RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143 |
| Red Hat JBoss EAP 7 | eap7-jboss-remoting | 5.0.29-1.Final_redhat_00001.1.el7eap | RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +2 | 1.10.0-37.Final_redhat_00037.1.el7eap | RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143 |
| Red Hat JBoss EAP 7 | eap7-jboss-xnio-base | 3.8.16-1.Final_redhat_00001.1.el7eap | RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143 |
| Red Hat JBoss EAP 7 | eap7-log4j-jboss-logmanager | 1.3.1-1.Final_redhat_00002.1.el7eap | RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143 |
| Red Hat JBoss EAP 7 | eap7-netty +28 | 4.1.108-1.Final_redhat_00001.1.el7eap | RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143 |
| Red Hat JBoss EAP 7 | eap7-netty-xnio-transport | 0.1.10-1.Final_redhat_00001.1.el7eap | RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.2.33-1.SP1_redhat_00001.1.el7eap | RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143 |
| Red Hat JBoss EAP 7 | eap7-wildfly +4 | 7.4.18-1.GA_redhat_00001.1.el7eap | RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk17 | 7.4.18-1.GA_redhat_00001.1.el8eap | RHSA-2024:5145, RHSA-2024:5144 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | io.undertow:undertow-core | >= 2.3.0.Alpha1, < 2.3.15.Final | 2.3.15.Final | GHSA-ch7q-gpff-h9hp |
| Maven | io.undertow:undertow-core | < 2.2.34.Final | 2.2.34.Final | GHSA-ch7q-gpff-h9hp |
Advisories 4
- RHSA-2024:5145 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.18 Security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2024:5143 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.18 Security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2024:5144 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.18 Security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- WID-SEC-2024-2206 Red Hat JBoss Enterprise Anwendungsplattform: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Jan 21, 2025
References
- RHSA-2024:4392 vendor-advisory
- RHSA-2024:5143 vendor-advisory
- RHSA-2024:5144 vendor-advisory
- RHSA-2024:5145 vendor-advisory
- RHSA-2024:5147 vendor-advisory
- RHSA-2024:6437 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2024-3653 vdb-entry
- RHBZ#2274437 issue-tracking