Undertow Vulnerability Leads to Denial of Service Attack

CVE-2024-5971
7.5HIGH

Key Information

Vendor
Red Hat
Status
Red Hat Build Of Apache Camel 4.4.1 For Spring Boot
Red Hat Build Of Apache Camel 4.4.2 For Spring Boot
Red Hat Jboss Enterprise Application Platform 7.1.0
Red Hat Jboss Enterprise Application Platform 7.4 For Rhel 8
Vendor
CVE Published:
8 July 2024

Summary

A vulnerability was found in Undertow, where the chunked response hangs after the body was flushed. The response headers and body were sent but the client would continue waiting as Undertow does not send the expected 0\r\n termination of the chunked response. This results in uncontrolled resource consumption, leaving the server side to a denial of service attack. This happens only with Java 17 TLSv1.3 scenarios.

Affected Version(s)

Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 <= 0:2.2.33-1.SP1_redhat_00001.1.el8eap

Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 <= 0:2.2.33-1.SP1_redhat_00001.1.el9eap

Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 <= 0:2.2.33-1.SP1_redhat_00001.1.el7eap

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Risk change from: null to: 7.5 - (HIGH)

  • Vulnerability published.

  • Vulnerability Reserved.

  • Reported to Red Hat.

Collectors

NVD DatabaseMitre Database
.