Uncontrolled resource consumption in Red Hat undertow
Priority LOW 37CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 11 fixed, 4 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
A vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS. An attacker can target the HTTPS port to carry out a Denial Of Service (DOS) to make the service unavailable on SSL.
Why it matters now
EPSS 0.02179 82nd percentileScored 2026-11-07
Fix Partial io.undertow:undertow-core (Maven): 2.0.29.FinalRed Hat: 11 advisoriesRed Hat: 11 fixed, 4 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | undertow | before 2.0.28.SP1 | 2.0.28.SP1 | Patch available | CNA |
| — | io.undertow:undertow-core (Maven) | before 2.0.29.Final | 2.0.29.Final | Patch available | GHSA-vjxc-frw4-jmh5 |
- undertow VendorRed Hat Affected before 2.0.28.SP1 Fixed in 2.0.28.SP1 Patch available CNA
- io.undertow:undertow-core (Maven) Vendor— Affected before 2.0.29.Final Fixed in 2.0.29.Final Patch available GHSA-vjxc-frw4-jmh5
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:* | up to 2.0.28 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_data_grid:-:*:*:*:text-only:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_data_grid:7.0.0:*:*:*:*:*:*:* | 7.0.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:* | 7.0.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_fuse:6.0.0:*:*:*:*:*:*:* | 6.0.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:* | 7.0.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:* Versions up to 2.0.28 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_data_grid:-:*:*:*:text-only:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_data_grid:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_fuse:6.0.0:*:*:*:*:*:*:* Versions 6.0.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
- Fix · GHSA-vjxc-frw4-jmh5 io.undertow:undertow-core (Maven) Fixed in 2.0.29.Final Advisory →
Red Hat 11 advisories
- RHSA-2024:5856 Released 2024-08-26 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.1.7 on RHEL 7 security update
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-apache-commons-beanutils-1.9.4-1.redhat_00002.1.ep7.el7, eap7-infinispan-8.2.11-1.SP2_redhat_00001.1.ep7.el7, eap7-infinispan-cachestore-jdbc-8.2.11-1.SP2_redhat_00001.1.ep7.el7 +12
- RHSA-2020:3192 Released 2020-07-28 · Red Hat rating ImportantRed Hat Fuse 7.7.0 release and security update
- Red Hat Fuse 7.7.0
- RHSA-2020:2367 Released 2020-06-04 · Red Hat rating ImportantRed Hat support for Spring Boot 2.1.13 security and bug fix update
- Red Hat Runtimes Spring Boot 2.1.13
Show 8 more Red Hat advisories
- RHSA-2020:2333 Released 2020-05-28 · Red Hat rating ImportantEAP Continuous Delivery Technical Preview Release 19 security update
- EAP-CD 19 Tech Preview
- RHSA-2020:2067 Released 2020-05-18 · Red Hat rating ImportantRed Hat build of Thorntail 2.5.1 security and bug fix update
- Text-Only RHOAR
- RHSA-2020:0729 Released 2020-03-05 · Red Hat rating ImportantRed Hat Data Grid 7.3.5 security update
- Red Hat Data Grid 7.3.5
- RHSA-2020:0445 Released 2020-02-06 · Red Hat rating ImportantRed Hat Single Sign-On 7.3.6 security update
- Red Hat Single Sign-On 7.3
- RHSA-2020:0160 Released 2020-01-21 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.6 on RHEL 7 security update
- Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-apache-cxf-3.2.11-1.redhat_00001.1.el7eap, eap7-apache-cxf-rt-3.2.11-1.redhat_00001.1.el7eap, eap7-apache-cxf-services-3.2.11-1.redhat_00001.1.el7eap +47
- RHSA-2020:0161 Released 2020-01-21 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.6 on RHEL 8 security update
- Red Hat JBoss EAP 7.2 for RHEL 8 eap7-apache-cxf-3.2.11-1.redhat_00001.1.el8eap, eap7-apache-cxf-rt-3.2.11-1.redhat_00001.1.el8eap, eap7-apache-cxf-services-3.2.11-1.redhat_00001.1.el8eap +47
- RHSA-2020:0159 Released 2020-01-21 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.6 on RHEL 6 security update
- Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-apache-cxf-3.2.11-1.redhat_00001.1.el6eap, eap7-apache-cxf-rt-3.2.11-1.redhat_00001.1.el6eap, eap7-apache-cxf-services-3.2.11-1.redhat_00001.1.el6eap +47
- RHSA-2020:0164 Released 2020-01-21 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.2.6 security update
- Red Hat JBoss EAP 7.2
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss Fuse 6 | Affected | No fix yet |
| Red Hat OpenShift Application Runtimes | Affected | No fix planned: Out of support scope |
| Red Hat Single Sign-On 7 | Affected | No fix yet |
| Red Hat support for Spring Boot | Affected | No fix yet |
| EAP-CD 19 Tech Preview | Fixed | RHSA-2020:2333 |
| Red Hat Data Grid 7.3.5 | Fixed | RHSA-2020:0729 |
| Red Hat Fuse 7.7.0 | Fixed | RHSA-2020:3192 |
| Red Hat JBoss EAP 7.2 | Fixed | RHSA-2020:0164 |
| Red Hat JBoss EAP 7.2 for RHEL 6 Server | Fixed | RHSA-2020:0159 |
| Red Hat JBoss EAP 7.2 for RHEL 7 Server | Fixed | RHSA-2020:0160 |
| Red Hat JBoss EAP 7.2 for RHEL 8 | Fixed | RHSA-2020:0161 |
| Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server | Fixed | RHSA-2024:5856 |
| Red Hat Runtimes Spring Boot 2.1.13 | Fixed | RHSA-2020:2367 |
| Red Hat Single Sign-On 7.3 | Fixed | RHSA-2020:0445 |
| Text-Only RHOAR | Fixed | RHSA-2020:2067 |
Not affected: 3 products
- Red Hat Decision Manager 7
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server
- Red Hat Process Automation 7
Timeline
- 2026-10-02 Threatist record created from CVE-2019-14888
- 2026-10-03 Alias added: GHSA-vjxc-frw4-jmh5
References
More Red Hat Jboss Data Grid vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2021-02983 Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2 CVSS 3.1HIGH 7.5
- TI-2019-11096 Information disclosure in Red Hat jackson-databind CVSS 3.1CRITICAL 9.8
- TI-2022-01156 Improper input validation in gzip, xz-utils CVSS 3.1HIGH 8.8
- TI-2019-02898 Sensitive information in log files in Red Hat undertow CVSS 3.1CRITICAL 9.8
- TI-2019-07532 Sensitive information in log files in Red Hat undertow CVSS 3.1CRITICAL 9.8
Sources
- CVE-2019-14888 · CVE Program
- CVE-2019-14888 · NVD
- FIRST EPSS
- GHSA-vjxc-frw4-jmh5 · GitHub Advisory Database · CC BY 4.0
- CVE-2019-14888 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences