Description
A vulnerability was found in Undertow, where the chunked response hangs after the body was flushed. The response headers and body were sent but the client would continue waiting as Undertow does not send the expected 0\r\n termination of the chunked response. This results in uncontrolled resource consumption, leaving the server side to a denial of service attack. This happens only with Java 17 TLSv1.3 scenarios.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | undertow | < 2.2.34.Final, 2.3.0.Alpha1 – < 2.3.15.Final | 2.2.34.Final |
| Red Hat | Red Hat build of Apache Camel 3.20.7 for Spring Boot | — | — |
| Red Hat | Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2 | — | — |
| Red Hat | Red Hat build of Apache Camel 4.4.2 for Spring Boot | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | — | — |
| Red Hat | Red Hat build of Apache Camel for Spring Boot 3 | — | — |
| Red Hat | Red Hat build of Apache Camel - HawtIO 4 | — | — |
| Red Hat | Red Hat Build of Keycloak | — | — |
| Red Hat | Red Hat build of Quarkus | — | — |
| Red Hat | Red Hat Data Grid 8 | — | — |
| Red Hat | Red Hat Fuse 7 | — | — |
| Red Hat | Red Hat Integration Camel K 1 | — | — |
| Red Hat | Red Hat JBoss Data Grid 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — | — |
| Red Hat | Red Hat Process Automation 7 | — | — |
| Red Hat | Red Hat Single Sign-On 7 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | undertow | 2.3.18-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | undertow | No fix yet | — |
| Ubuntu 26.04 LTS | undertow | No fix yet | — |
| Ubuntu 25.10 | undertow | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | undertow | No fix yet | — |
| Ubuntu Pro 22.04 LTS | undertow | No fix yet | — |
| Ubuntu Pro 20.04 LTS | undertow | No fix yet | — |
| Ubuntu Pro 18.04 LTS | undertow | No fix yet | — |
| Ubuntu Pro 16.04 LTS | undertow | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 7 | eap7-bouncycastle +5 | 1.78.1-1.redhat_00002.1.el7eap | RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.3.23-1.Final_redhat_00001.1.el7eap | RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.5.17-1.Final_redhat_00001.1.el7eap | RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143 |
| Red Hat JBoss EAP 7 | eap7-jandex | 2.4.5-1.Final_redhat_00001.1.el7eap | RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143 |
| Red Hat JBoss EAP 7 | eap7-jboss-remoting | 5.0.29-1.Final_redhat_00001.1.el7eap | RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +2 | 1.10.0-37.Final_redhat_00037.1.el7eap | RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143 |
| Red Hat JBoss EAP 7 | eap7-jboss-xnio-base | 3.8.16-1.Final_redhat_00001.1.el7eap | RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143 |
| Red Hat JBoss EAP 7 | eap7-log4j-jboss-logmanager | 1.3.1-1.Final_redhat_00002.1.el7eap | RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143 |
| Red Hat JBoss EAP 7 | eap7-netty +28 | 4.1.108-1.Final_redhat_00001.1.el7eap | RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143 |
| Red Hat JBoss EAP 7 | eap7-netty-xnio-transport | 0.1.10-1.Final_redhat_00001.1.el7eap | RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.2.33-1.SP1_redhat_00001.1.el7eap | RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143 |
| Red Hat JBoss EAP 7 | eap7-wildfly +4 | 7.4.18-1.GA_redhat_00001.1.el7eap | RHSA-2024:5145, RHSA-2024:5144, RHSA-2024:5143 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk17 | 7.4.18-1.GA_redhat_00001.1.el8eap | RHSA-2024:5145, RHSA-2024:5144 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | io.undertow:undertow-core | >= 2.3.0.Alpha1, < 2.3.15.Final | 2.3.15.Final | GHSA-xpp6-8r3j-ww43 |
| Maven | io.undertow:undertow-core | < 2.2.34.Final | 2.2.34.Final | GHSA-xpp6-8r3j-ww43 |
Advisories 5
- RHSA-2024:5145 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.18 Security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2024:5143 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.18 Security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2024:5144 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.18 Security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- WID-SEC-2024-3195 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- NCSC-2024-0414 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Oct 17, 2024
References
- RHSA-2024:4392 vendor-advisory
- RHSA-2024:4884 vendor-advisory
- RHSA-2024:5143 vendor-advisory
- RHSA-2024:5144 vendor-advisory
- RHSA-2024:5145 vendor-advisory
- RHSA-2024:5147 vendor-advisory
- RHSA-2024:6508 vendor-advisory
- RHSA-2024:6883 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2024-5971 vdb-entry
- RHBZ#2292211 issue-tracking