Read the docs
TI-2023-04950 Aliases CVE-2023-5379GHSA-q462-4hrv-w27r

Undertow: ajp request closes connection exceeding maxrequestsize

Priority MEDIUM 41CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 2 fixed, 7 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-770.

Summary

A flaw was found in Undertow. When an AJP request is sent that exceeds the max-header-size attribute in ajp-listener, JBoss EAP is marked in an error state by mod_cluster in httpd, causing JBoss EAP to close the TCP connection without returning an AJP response. This happens because mod_proxy_cluster marks the JBoss EAP instance as an error worker when the TCP connection is closed from the backend after sending the AJP request without receiving an AJP response, and stops forwarding. This issue could allow a malicious user could to repeatedly send requests that exceed the max-header-size, causing a Denial of Service (DoS).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01025 63rd percentileScored 2026-11-07
Fix Partial Red Hat: 2 advisoriesRed Hat: 2 fixed, 7 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatRed Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7—3.0.1-4.b08_redhat_00005.1.ep7.el7Patch availableCNA
Red HatRed Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7—5.1.17-3.Final_redhat_00004.1.ep7.el7Patch availableCNA
Red HatRed Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7—2.8.11.6-3.SP1_redhat_00003.1.ep7.el7Patch availableCNA
Red HatRed Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7—4.0.12-1.Final_redhat_00002.1.ep7.el7Patch availableCNA
Red HatRed Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7—4.1.63-2.Final_redhat_00003.1.ep7.el7Patch availableCNA
Red HatRed Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7—1.4.18-16.SP14_redhat_00001.1.ep7.el7Patch availableCNA
Red HatRed Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7—7.1.11-4.GA_redhat_00002.1.ep7.el7Patch availableCNA
Red HatRed Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7—1.1.14-1.Final_redhat_00001.1.ep7.el7Patch availableCNA
Red HatRed Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7—1.0.21-1.Final_redhat_00001.1.ep7.el7Patch availableCNA
Red HatRed Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7—1.0.13-1.Final_redhat_00001.1.ep7.el7Patch availableCNA
Red HatRed Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7—1.0.12-1.Final_redhat_00001.1.ep7.el7Patch availableCNA
Red HatRed Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7—1.0.12-6.Final_redhat_00001.1.ep7.el7Patch availableCNA
Red HatRed Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7—2.10.4-3.redhat_00006.1.el7eapPatch availableCNA
Red HatRed Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7—2.10.4-3.redhat_00006.1.el7eapPatch availableCNA
Red HatRed Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7—2.10.4-5.redhat_00006.1.el7eapPatch availableCNA
Red HatRed Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7—2.10.4-3.redhat_00006.1.el7eapPatch availableCNA
Red HatRed Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7—2.10.4-5.redhat_00006.1.el7eapPatch availableCNA
Red HatRed Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7—2.10.4-2.redhat_00006.1.el7eapPatch availableCNA
Red HatRed Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7—1.7.2-16.Final_redhat_00017.1.el7eapPatch availableCNA
Red HatRed Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7—4.1.63-5.Final_redhat_00003.1.el7eapPatch availableCNA
Red HatRed Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7—2.0.41-4.SP5_redhat_00001.1.el7eapPatch availableCNA
Red HatRed Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7—7.3.14-3.GA_redhat_00002.1.el7eapPatch availableCNA
Red HatRed Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7—1.10.17-1.Final_redhat_00001.1.el7eapPatch availableCNA
Red HatRed Hat build of Quarkus——Not affectedCNA
Red HatRed Hat Data Grid 8——Not affectedCNA
Red HatRed Hat Decision Manager 7——No fix listedCNA
Red HatRed Hat Fuse 7——No fix listedCNA
Red HatRed Hat JBoss Data Grid 7——No fix listedCNA
Red HatRed Hat JBoss Enterprise Application Platform 7——No fix listedCNA
Red HatRed Hat JBoss Fuse 6——No fix listedCNA
Red HatRed Hat Process Automation 7——No fix listedCNA
Red HatRed Hat Single Sign-On 7——No fix listedCNA
Red HatRed Hat support for Spring Boot——Not affectedCNA
  • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 3.0.1-4.b08_redhat_00005.1.ep7.el7 Patch available CNA
  • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 5.1.17-3.Final_redhat_00004.1.ep7.el7 Patch available CNA
  • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 2.8.11.6-3.SP1_redhat_00003.1.ep7.el7 Patch available CNA
  • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 4.0.12-1.Final_redhat_00002.1.ep7.el7 Patch available CNA
  • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 4.1.63-2.Final_redhat_00003.1.ep7.el7 Patch available CNA
  • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 1.4.18-16.SP14_redhat_00001.1.ep7.el7 Patch available CNA
  • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 7.1.11-4.GA_redhat_00002.1.ep7.el7 Patch available CNA
  • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 1.1.14-1.Final_redhat_00001.1.ep7.el7 Patch available CNA
  • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 1.0.21-1.Final_redhat_00001.1.ep7.el7 Patch available CNA
  • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 1.0.13-1.Final_redhat_00001.1.ep7.el7 Patch available CNA
  • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 1.0.12-1.Final_redhat_00001.1.ep7.el7 Patch available CNA
  • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 1.0.12-6.Final_redhat_00001.1.ep7.el7 Patch available CNA
  • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 2.10.4-3.redhat_00006.1.el7eap Patch available CNA
  • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 2.10.4-3.redhat_00006.1.el7eap Patch available CNA
  • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 2.10.4-5.redhat_00006.1.el7eap Patch available CNA
  • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 2.10.4-3.redhat_00006.1.el7eap Patch available CNA
  • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 2.10.4-5.redhat_00006.1.el7eap Patch available CNA
  • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 2.10.4-2.redhat_00006.1.el7eap Patch available CNA
  • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 1.7.2-16.Final_redhat_00017.1.el7eap Patch available CNA
  • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 4.1.63-5.Final_redhat_00003.1.el7eap Patch available CNA
  • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 2.0.41-4.SP5_redhat_00001.1.el7eap Patch available CNA
  • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 7.3.14-3.GA_redhat_00002.1.el7eap Patch available CNA
  • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 1.10.17-1.Final_redhat_00001.1.el7eap Patch available CNA
  • Red Hat build of Quarkus VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat Data Grid 8 VendorRed Hat Affected — Fixed in — Not affected CNA
  • Red Hat Decision Manager 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Fuse 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat JBoss Data Grid 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat JBoss Enterprise Application Platform 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat JBoss Fuse 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Process Automation 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat Single Sign-On 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
  • Red Hat support for Spring Boot VendorRed Hat Affected — Fixed in — Not affected CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*7.0.0VulnerableRed Hat
cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:a:redhat:undertow:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:undertow:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat

Remediation

Red Hat 2 advisories

  • RHSA-2025:9582 Released 2025-06-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.11 on RHEL 7 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-glassfish-el-3.0.1-4.b08_redhat_00005.1.ep7.el7, eap7-glassfish-el-impl-3.0.1-4.b08_redhat_00005.1.ep7.el7, eap7-hibernate-5.1.17-3.Final_redhat_00004.1.ep7.el7 +22
  • RHSA-2025:9583 Released 2025-06-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.14 Security update
    • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-jackson-annotations-2.10.4-3.redhat_00006.1.el7eap, eap7-jackson-core-2.10.4-3.redhat_00006.1.el7eap, eap7-jackson-databind-2.10.4-5.redhat_00006.1.el7eap +40

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Decision Manager 7AffectedNo fix planned: Out of support scope
Red Hat Fuse 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 7AffectedNo fix yet
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat Process Automation 7AffectedNo fix planned: Out of support scope
Red Hat Single Sign-On 7AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 ServerFixed RHSA-2025:9582
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 ServerFixed RHSA-2025:9583
Not affected: 3 products
  • Red Hat Data Grid 8
  • Red Hat build of Quarkus
  • Red Hat support for Spring Boot

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-5379
  2. 2026-10-03 Alias added: GHSA-q462-4hrv-w27r

References

Advisory 4

Other 1

  • TI-2017-08941 Deserialization of untrusted data in Red Hat jbossas KEVCVSS 3.1CRITICAL 9.8
  • TI-2010-01790 JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for… KEVCVSS 3.1HIGH 8.8
  • TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2010-01383 The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application… KEVCVSS 3.1HIGH 7.5
  • TI-2017-09354 XML external entity injection in Apache Solr before 7.1 with Apache Lucene before 7.1 CVSS 3.1CRITICAL 9.8
See all 243 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences