Read the docs
TI-2018-01032 Aliases CVE-2018-1114GHSA-gjjx-gqm4-wcgm

Uncontrolled resource consumption in Red Hat undertow

Priority LOW 33CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 7 fixed, 4 without a fix

Attack profile from CVSS 3.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

It was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized which can cause file descriptors to exhaust. This leads to a file handler leak.

Why it matters now

EPSS 0.02329 83rd percentileScored 2026-11-07
Fix Partial io.undertow:undertow-core (Maven): 1.4.25.Final, 2.0.5.FinalRed Hat: 6 advisoriesRed Hat: 7 fixed, 4 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red Hatundertowall versions—No fix listedCNA
—io.undertow:undertow-core (Maven)before 1.4.25.Final1.4.25.FinalPatch availableGHSA-gjjx-gqm4-wcgm
—io.undertow:undertow-core (Maven)2.0.0.Alpha1 to before 2.0.5.Final2.0.5.FinalPatch availableGHSA-gjjx-gqm4-wcgm
  • undertow VendorRed Hat Affected all versions Fixed in — No fix listed CNA
  • io.undertow:undertow-core (Maven) Vendor— Affected before 1.4.25.Final Fixed in 1.4.25.Final Patch available GHSA-gjjx-gqm4-wcgm
  • io.undertow:undertow-core (Maven) Vendor— Affected 2.0.0.Alpha1 to before 2.0.5.Final Fixed in 2.0.5.Final Patch available GHSA-gjjx-gqm4-wcgm

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:redhat:undertow:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*4.0VulnerableRed Hat
cpe:2.3:a:redhat:virtualization:4.2:*:*:*:*:*:*:*4.2VulnerableRed Hat
cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*4.0VulnerableRed Hat
  • cpe:2.3:a:redhat:undertow:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:virtualization:4.2:*:*:*:*:*:*:* Versions 4.2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-gjjx-gqm4-wcgm io.undertow:undertow-core (Maven) Fixed in 1.4.25.Final Advisory →
  • Fix · GHSA-gjjx-gqm4-wcgm io.undertow:undertow-core (Maven) Fixed in 2.0.5.Final Advisory →

Red Hat 6 advisories

  • RHSA-2019:0877 Released 2019-04-24 · Red Hat rating Important
    Red Hat OpenShift Application Runtimes Thorntail 2.4.0 security & bug fix update
    • Text-Only RHOAR
  • RHSA-2018:2669 Released 2018-09-11 · Red Hat rating Important
    Fuse 7.1 security update
    • Red Hat Fuse 7
  • RHSA-2018:2643 Released 2018-09-04 · Red Hat rating Important
    rhvm-appliance security update
    • Red Hat Virtualization 4 Hypervisor for RHEL 7 rhvm-appliance-2:4.2-20180828.0.el7
    • Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts rhvm-appliance-2:4.2-20180828.0.el7
Show 3 more Red Hat advisories
  • RHSA-2018:2089 Released 2018-06-27 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform security update
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server eap7-activemq-artemis-1.5.5.012-1.redhat_1.1.ep7.el7, eap7-activemq-artemis-cli-1.5.5.012-1.redhat_1.1.ep7.el7, eap7-activemq-artemis-commons-1.5.5.012-1.redhat_1.1.ep7.el7 +47
  • RHSA-2018:2090 Released 2018-06-27 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform security update
    • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server eap7-activemq-artemis-1.5.5.012-1.redhat_1.1.ep7.el6, eap7-activemq-artemis-cli-1.5.5.012-1.redhat_1.1.ep7.el6, eap7-activemq-artemis-commons-1.5.5.012-1.redhat_1.1.ep7.el6 +47
  • RHSA-2018:2088 Released 2018-06-27 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.1.3 security update
    • Red Hat JBoss EAP 7.1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Fuse 6AffectedNo fix planned: Will not fix
Red Hat JBoss Fuse Integration Service 2AffectedNo fix yet
Red Hat OpenShift Application RuntimesAffectedNo fix yet
Red Hat Single Sign-On 7AffectedNo fix yet
Red Hat Fuse 7Fixed RHSA-2018:2669
Red Hat JBoss EAP 7.1Fixed RHSA-2018:2088
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 ServerFixed RHSA-2018:2090
Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 ServerFixed RHSA-2018:2089
Red Hat Virtualization 4 Hypervisor for RHEL 7Fixed RHSA-2018:2643
Red Hat Virtualization 4 Management Agent for RHEL 7 HostsFixed RHSA-2018:2643
Text-Only RHOARFixed RHSA-2019:0877
Not affected: 2 products
  • Red Hat JBoss Data Grid 7
  • Red Hat JBoss Enterprise Application Platform 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-1114
  2. 2026-10-03 Alias added: GHSA-gjjx-gqm4-wcgm
  3. 2026-11-03 Fix available: Red Hat Fuse 7 · Red Hat

References

Advisory 7

  • TI-2025-11507 Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf CVSS 3.1CRITICAL 9.6
  • TI-2020-01688 Improper authorization in undertow-io undertow CVSS 3.1CRITICAL 9.8
  • TI-2019-02898 Sensitive information in log files in Red Hat undertow CVSS 3.1CRITICAL 9.8
  • TI-2019-07532 Sensitive information in log files in Red Hat undertow CVSS 3.1CRITICAL 9.8
  • TI-2023-03019 Undertow: outofmemoryerror due to @multipartconfig handling CVSS 3.1HIGH 7.5
  • TI-2014-06490 Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x before… CVSS 2.0MEDIUM 5.0
See all 38 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences