Undertow: infinite loop in sslconduit during close
Priority LOW 36CWE-835Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 15 fixed, 6 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-835.
Summary
A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01771 78th percentileScored 2026-11-07
Fix Partial io.undertow:undertow-core: 2.3.5, 2.2.24io.undertow:undertow-core (Maven): 2.3.5.Final, 2.2.24.FinalRed Hat: 16 advisoriesRed Hat: 15 fixed, 6 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | io.undertow:undertow-core | — | 2.3.5, 2.2.24 | Patch available | CNA |
| Red Hat | EAP 7.4.10 release | — | — | Not affected | CNA |
| Red Hat | Red Hat Fuse 7.12 | — | — | Not affected | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.1.0 | — | — | Not affected | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 2.2.22-1.SP3_redhat_00002.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 7.4.9-6.GA_redhat_00004.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 2.2.23-1.SP2_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 2.0.14-1.Final_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 2.2.22-1.SP3_redhat_00002.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 7.4.9-6.GA_redhat_00004.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 2.2.23-1.SP2_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 2.0.14-1.Final_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | — | 2.2.22-1.SP3_redhat_00002.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | — | 7.4.9-6.GA_redhat_00004.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | — | 2.2.23-1.SP2_redhat_00001.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | — | 2.0.14-1.Final_redhat_00001.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat Single Sign-On 7 | — | — | Not affected | CNA |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 7 | — | 18.0.8-1.redhat_00001.1.el7sso | Patch available | CNA |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 8 | — | 18.0.8-1.redhat_00001.1.el8sso | Patch available | CNA |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 9 | — | 18.0.8-1.redhat_00001.1.el9sso | Patch available | CNA |
| Red Hat | Red Hat support for Spring Boot 2.7.13 | — | — | Not affected | CNA |
| Red Hat | RHEL-8 based Middleware Containers | — | 7.6-24 | Patch available | CNA |
| Red Hat | RHPAM 7.13.1 async | — | — | Not affected | CNA |
| Red Hat | Red Hat build of Quarkus | — | — | Not affected | CNA |
| Red Hat | Red Hat Data Grid 8 | — | — | Not affected | CNA |
| Red Hat | Red Hat Integration Camel K | — | — | No fix listed | CNA |
| Red Hat | Red Hat Integration Camel Quarkus | — | — | Not affected | CNA |
| Red Hat | Red Hat Integration Service Registry | — | — | No fix listed | CNA |
| Red Hat | Red Hat JBoss Data Grid 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — | — | No fix listed | CNA |
| Red Hat | Red Hat JBoss Fuse 6 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenStack Platform 13 (Queens) | — | — | No fix listed | CNA |
| — | io.undertow:undertow-core (Maven) | 2.3.0 to before 2.3.5.Final | 2.3.5.Final | Patch available | GHSA-m4mm-pg93-fv78 |
| — | io.undertow:undertow-core (Maven) | before 2.2.24.Final | 2.2.24.Final | Patch available | GHSA-m4mm-pg93-fv78 |
- io.undertow:undertow-core Vendor— Affected — Fixed in 2.3.5, 2.2.24 Patch available CNA
- EAP 7.4.10 release VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Fuse 7.12 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat JBoss Enterprise Application Platform 7.1.0 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 2.2.22-1.SP3_redhat_00002.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 7.4.9-6.GA_redhat_00004.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 2.2.23-1.SP2_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 2.0.14-1.Final_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 2.2.22-1.SP3_redhat_00002.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 7.4.9-6.GA_redhat_00004.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 2.2.23-1.SP2_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 2.0.14-1.Final_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 VendorRed Hat Affected — Fixed in 2.2.22-1.SP3_redhat_00002.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 VendorRed Hat Affected — Fixed in 7.4.9-6.GA_redhat_00004.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 VendorRed Hat Affected — Fixed in 2.2.23-1.SP2_redhat_00001.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 VendorRed Hat Affected — Fixed in 2.0.14-1.Final_redhat_00001.1.el7eap Patch available CNA
- Red Hat Single Sign-On 7 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Single Sign-On 7.6 for RHEL 7 VendorRed Hat Affected — Fixed in 18.0.8-1.redhat_00001.1.el7sso Patch available CNA
- Red Hat Single Sign-On 7.6 for RHEL 8 VendorRed Hat Affected — Fixed in 18.0.8-1.redhat_00001.1.el8sso Patch available CNA
- Red Hat Single Sign-On 7.6 for RHEL 9 VendorRed Hat Affected — Fixed in 18.0.8-1.redhat_00001.1.el9sso Patch available CNA
- Red Hat support for Spring Boot 2.7.13 VendorRed Hat Affected — Fixed in — Not affected CNA
- RHEL-8 based Middleware Containers VendorRed Hat Affected — Fixed in 7.6-24 Patch available CNA
- RHPAM 7.13.1 async VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat build of Quarkus VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Data Grid 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Integration Camel K VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Integration Camel Quarkus VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Integration Service Registry VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat JBoss Data Grid 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat JBoss Enterprise Application Platform Expansion Pack VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat JBoss Fuse 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenStack Platform 13 (Queens) VendorRed Hat Affected — Fixed in — No fix listed CNA
- io.undertow:undertow-core (Maven) Vendor— Affected 2.3.0 to before 2.3.5.Final Fixed in 2.3.5.Final Patch available GHSA-m4mm-pg93-fv78
- io.undertow:undertow-core (Maven) Vendor— Affected before 2.2.24.Final Fixed in 2.2.24.Final Patch available GHSA-m4mm-pg93-fv78
CPE configurations NVD · 24
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:build_of_quarkus:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:decision_manager:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:fuse:1.0.0:*:*:*:*:*:*:* | 1.0.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:integration_camel_k:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:integration_service_registry:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_application_platform_expansion_pack:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:text-only:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openstack_platform:13.0:*:*:*:*:*:*:* | 13.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
- cpe:2.3:a:redhat:build_of_quarkus:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:decision_manager:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:fuse:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:integration_camel_k:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:integration_service_registry:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_application_platform_expansion_pack:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:text-only:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openstack_platform:13.0:*:*:*:*:*:*:* Versions 13.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
Show 14 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:* | before 2.2.24; 2.3.0 to before 2.3.5 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform:4.11:*:*:*:*:*:*:* | 4.11 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform:4.12:*:*:*:*:*:*:* | 4.12 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.9:*:*:*:*:*:*:* | 4.9 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.10:*:*:*:*:*:*:* | 4.10 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform_for_power:4.9:*:*:*:*:*:*:* | 4.9 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform_for_power:4.10:*:*:*:*:*:*:* | 4.10 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Running on | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:* | 7.4 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* | 7.0 | Running on | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* | 9.0 | Running on | Red Hat |
| cpe:2.3:a:redhat:single_sign-on:7.6:*:*:*:*:*:*:* | 7.6 | Vulnerable | Red Hat |
| cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:* Versions before 2.2.24; 2.3.0 to before 2.3.5 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform:4.11:*:*:*:*:*:*:* Versions 4.11 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform:4.12:*:*:*:*:*:*:* Versions 4.12 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.9:*:*:*:*:*:*:* Versions 4.9 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.10:*:*:*:*:*:*:* Versions 4.10 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform_for_power:4.9:*:*:*:*:*:*:* Versions 4.9 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform_for_power:4.10:*:*:*:*:*:*:* Versions 4.10 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Running on ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Running on ·Red Hat
- cpe:2.3:a:redhat:single_sign-on:7.6:*:*:*:*:*:*:* Versions 7.6 Vulnerable ·Red Hat
- cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
- Fix · CNA io.undertow:undertow-core Fixed in 2.3.5, 2.2.24
- Fix · GHSA-m4mm-pg93-fv78 io.undertow:undertow-core (Maven) Fixed in 2.3.5.Final Advisory →
- Fix · GHSA-m4mm-pg93-fv78 io.undertow:undertow-core (Maven) Fixed in 2.2.24.Final Advisory →
Red Hat 16 advisories
- RHSA-2025:9583 Released 2025-06-25 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.3.14 Security update
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-jackson-annotations-2.10.4-3.redhat_00006.1.el7eap, eap7-jackson-core-2.10.4-3.redhat_00006.1.el7eap, eap7-jackson-databind-2.10.4-5.redhat_00006.1.el7eap +40
- RHSA-2025:4226 Released 2025-04-28 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.1.10 on RHEL 7 security update
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-activemq-artemis-1.5.5.016-1.redhat_00001.1.ep7.el7, eap7-activemq-artemis-cli-1.5.5.016-1.redhat_00001.1.ep7.el7, eap7-activemq-artemis-commons-1.5.5.016-1.redhat_00001.1.ep7.el7 +22
- RHSA-2023:4612 Released 2023-08-16 · Red Hat rating ImportantRed Hat support for Spring Boot 2.7.13 security update
- Red Hat support for Spring Boot 2.7.13
Show 13 more Red Hat advisories
- RHSA-2023:3954 Released 2023-06-29 · Red Hat rating CriticalRed Hat Fuse 7.12 release and security update
- Red Hat Fuse 7.12
- RHSA-2023:3883 Released 2023-06-27 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.4 security update on RHEL 7
- Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak-18.0.8-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server-18.0.8-1.redhat_00001.1.el7sso
- RHSA-2023:3892 Released 2023-06-27 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.4 security update
- Red Hat Single Sign-On 7
- RHSA-2023:3884 Released 2023-06-27 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.4 security update on RHEL 8
- Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak-18.0.8-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-18.0.8-1.redhat_00001.1.el8sso
- RHSA-2023:3885 Released 2023-06-27 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.4 security update on RHEL 9
- Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak-18.0.8-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server-18.0.8-1.redhat_00001.1.el9sso
- RHSA-2023:3888 Released 2023-06-27 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.4 for OpenShift image security enhancement update
- Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8
- RHSA-2023:2135 Released 2023-05-04 · Red Hat rating ImportantRed Hat Process Automation Manager 7.13.3 security update
- RHPAM 7.13.1 async
- RHSA-2023:1516 Released 2023-03-29 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.10 security update
- Red Hat JBoss Enterprise Application Platform com.h2database.h2-1.4.197.redhat-00004.jar, io.netty.netty-codec-haproxy-4.1.86.Final-redhat-00001.jar, io.undertow.undertow-core-2.2.23.SP2-redhat-00001.jar +3
- RHSA-2023:1512 Released 2023-03-29 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 7 security update
- Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-activemq-artemis-native-1:1.0.2-3.redhat_00004.1.el7eap, eap7-apache-mime4j-0.8.9-1.redhat_00001.1.el7eap, eap7-artemis-native-1:1.0.2-4.redhat_00004.1.el7eap +47
- RHSA-2023:1513 Released 2023-03-29 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 8 security update
- Red Hat JBoss EAP 7.4 for RHEL 8 eap7-activemq-artemis-native-1:1.0.2-3.redhat_00004.1.el8eap, eap7-apache-mime4j-0.8.9-1.redhat_00001.1.el8eap, eap7-artemis-native-1:1.0.2-4.redhat_00004.1.el8eap +47
- RHSA-2023:1514 Released 2023-03-29 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.10 on RHEL 9 security update
- Red Hat JBoss EAP 7.4 for RHEL 9 eap7-activemq-artemis-native-1:1.0.2-3.redhat_00004.1.el9eap, eap7-apache-mime4j-0.8.9-1.redhat_00001.1.el9eap, eap7-artemis-native-1:1.0.2-4.redhat_00004.1.el9eap +47
- RHSA-2023:1185 Released 2023-03-09 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4 security update
- Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-undertow-2.2.22-1.SP3_redhat_00002.1.el7eap, eap7-wildfly-7.4.9-6.GA_redhat_00004.1.el7eap, eap7-wildfly-java-jdk11-7.4.9-6.GA_redhat_00004.1.el7eap +3
- Red Hat JBoss EAP 7.4 for RHEL 8 eap7-undertow-2.2.22-1.SP3_redhat_00002.1.el8eap, eap7-wildfly-7.4.9-6.GA_redhat_00004.1.el8eap, eap7-wildfly-javadocs-7.4.9-6.GA_redhat_00004.1.el8eap +1
- Red Hat JBoss EAP 7.4 for RHEL 9 eap7-undertow-2.2.22-1.SP3_redhat_00002.1.el9eap, eap7-wildfly-7.4.9-6.GA_redhat_00004.1.el9eap, eap7-wildfly-javadocs-7.4.9-6.GA_redhat_00004.1.el9eap +1
- RHSA-2023:1184 Released 2023-03-09 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4 security update
- Red Hat JBoss Enterprise Application Platform 7.4.9 io.undertow.undertow-core-2.2.22.SP3-redhat-00001.jar
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Integration Camel K 1 | Affected | No fix yet |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix yet |
| Red Hat build of Apicurio Registry 2 | Affected | No fix yet |
| Middleware Containers for OpenShift | Fixed | RHSA-2023:3888 |
| RHPAM 7.13.1 async | Fixed | RHSA-2023:2135 |
| Red Hat Fuse 7.12 | Fixed | RHSA-2023:3954 |
| Red Hat JBoss EAP 7.4 for RHEL 7 Server | Fixed | RHSA-2023:1185, RHSA-2023:1512 |
| Red Hat JBoss EAP 7.4 for RHEL 8 | Fixed | RHSA-2023:1185, RHSA-2023:1513 |
| Red Hat JBoss EAP 7.4 for RHEL 9 | Fixed | RHSA-2023:1185, RHSA-2023:1514 |
| Red Hat JBoss Enterprise Application Platform | Fixed | RHSA-2023:1516 |
| Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server | Fixed | RHSA-2025:4226 |
| Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server | Fixed | RHSA-2025:9583 |
| Red Hat JBoss Enterprise Application Platform 7.4.9 | Fixed | RHSA-2023:1184 |
| Red Hat Single Sign-On 7 | Fixed | RHSA-2023:3892 |
| Red Hat Single Sign-On 7.6 for RHEL 7 Server | Fixed | RHSA-2023:3883 |
| Red Hat Single Sign-On 7.6 for RHEL 8 | Fixed | RHSA-2023:3884 |
| Red Hat Single Sign-On 7.6 for RHEL 9 | Fixed | RHSA-2023:3885 |
| Red Hat support for Spring Boot 2.7.13 | Fixed | RHSA-2023:4612 |
Not affected: 8 products
- Red Hat Data Grid 8
- Red Hat Integration Camel Quarkus 1
- Red Hat JBoss EAP 7.4 for RHEL 7 Server
- Red Hat JBoss EAP 7.4 for RHEL 8
- Red Hat JBoss EAP 7.4 for RHEL 9
- Red Hat JBoss Enterprise Application Platform
- Red Hat JBoss Enterprise Application Platform 7.4.9
- Red Hat build of Quarkus
Timeline
- 2026-10-02 Threatist record created from CVE-2023-1108
- 2026-10-03 Alias added: GHSA-m4mm-pg93-fv78
References
Advisory 18
- RHSA-2023:1184
- RHSA-2023:1185
- RHSA-2023:1512
- RHSA-2023:1513
- RHSA-2023:1514
- RHSA-2023:1516
- RHSA-2023:2135
- RHSA-2023:3883
- RHSA-2023:3884
- RHSA-2023:3885
- RHSA-2023:3888
- RHSA-2023:3892
- RHSA-2023:3954
- RHSA-2023:4612
- https://access.redhat.com/security/cve/CVE-2023-1108
- https://github.com/advisories/GHSA-m4mm-pg93-fv78
- https://security.netapp.com/advisory/ntap-20231020-0002/
- https://nvd.nist.gov/vuln/detail/CVE-2023-1108
Other 7
- RHBZ#2174246
- https://github.com/undertow-io/undertow/pull/1457
- https://github.com/undertow-io/undertow/commit/ccc053b55f5de9872bc1a4999fd6aa85fc5e146d
- https://github.com/undertow-io/undertow/commit/1b763064a41a30583b5df9a118898513007a70be
- https://github.com/undertow-io/undertow/commit/1302c8cf4476936802504efe0d36c58dcd954f78
- https://security.netapp.com/advisory/ntap-20231020-0002
- https://github.com/undertow-io/undertow
More Red Hat Build Of Quarkus vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2022-03763 Injection in quarkus CVSS 3.1CRITICAL 9.8
- TI-2023-05869 Quarkus: graphql operations over websockets bypass CVSS 3.1CRITICAL 9.1
- TI-2023-04469 Quarkus: http security policy bypass CVSS 3.1HIGH 8.1
- TI-2022-04106 Server-side request forgery in undertow CVSS 3.1HIGH 7.5
- TI-2023-02786 Quarkus-core: tls protocol configured with quarkus.http.ssl.protocols is not enforced… CVSS 3.1HIGH 8.1
Sources
- CVE-2023-1108 · CVE Program
- CVE-2023-1108 · NVD
- FIRST EPSS
- GHSA-m4mm-pg93-fv78 · GitHub Advisory Database · CC BY 4.0
- CVE-2023-1108 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences