Undertow: out-of-memory error after several closed connections with wildfly-http-client protocol
Priority MEDIUM 40CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 13 fixed, 4 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and closes a connection with the HTTP port of the server and then closes the connection immediately, the server will end with both memory and open file limits exhausted at some point, depending on the amount of memory available. At HTTP upgrade to remoting, the WriteTimeoutStreamSinkConduit leaks connections if RemotingConnection is closed by Remoting ServerConnectionOpenListener. Because the remoting connection originates in Undertow as part of the HTTP upgrade, there is an external layer to the remoting connection. This connection is unaware of the outermost layer when closing the connection during the connection opening procedure. Hence, the Undertow WriteTimeoutStreamSinkConduit is not notified of the closed connection in this scenario. Because WriteTimeoutStreamSinkConduit creates a timeout task, the whole dependency tree leaks via that task, which is added to XNIO WorkerThread. So, the workerThread points to the Undertow conduit, which contains the connections and causes the leak.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.04572 91st percentileScored 2026-11-07
Fix Partial io.undertow:undertow-core (Maven): 2.3.12.Final, 2.2.31.FinalRed Hat: 13 advisoriesRed Hat: 13 fixed, 4 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | undertow | 1.31.0 | — | No fix listed | CNA |
| Red Hat | Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2 | — | — | Not affected | CNA |
| Red Hat | Red Hat Fuse 7.13.0 | — | — | Not affected | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 | — | 1.5.5.016-1.redhat_00001.1.ep7.el7 | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 | — | 1:1.5.5.016-1.redhat_00001.1.ep7.el7 | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 | — | 3.5.11-1.Final_redhat_00001.1.ep7.el7 | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 | — | 1.14.2-1.redhat_00002.1.ep7.el7 | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 | — | 1.4.18-14.SP13_redhat_00001.1.ep7.el7 | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 | — | 7.1.10-2.GA_redhat_00002.1.ep7.el7 | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 | — | 5.0.3-2.redhat_00002.1.ep7.el7 | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 | — | 2.0.10-2.redhat_00002.1.ep7.el7 | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | — | 2.10.4-3.redhat_00006.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | — | 2.10.4-3.redhat_00006.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | — | 2.10.4-5.redhat_00006.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | — | 2.10.4-3.redhat_00006.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | — | 2.10.4-5.redhat_00006.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | — | 2.10.4-2.redhat_00006.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | — | 1.7.2-16.Final_redhat_00017.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | — | 4.1.63-5.Final_redhat_00003.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | — | 2.0.41-4.SP5_redhat_00001.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | — | 7.3.14-3.GA_redhat_00002.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | — | 1.10.17-1.Final_redhat_00001.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4.16 | — | 2.2.30.SP1-redhat-00001 | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 2.2.30-1.SP1_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 2.2.30-1.SP1_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | — | 2.2.30-1.SP1_redhat_00001.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 7 | — | 18.0.13-1.redhat_00001.1.el7sso | Patch available | CNA |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 8 | — | 18.0.13-1.redhat_00001.1.el8sso | Patch available | CNA |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 9 | — | 18.0.13-1.redhat_00001.1.el9sso | Patch available | CNA |
| Red Hat | RHEL-8 based Middleware Containers | — | 7.6-46 | Patch available | CNA |
| Red Hat | RHSSO 7.6.8 | — | — | Not affected | CNA |
| Red Hat | OpenShift Serverless | — | — | Not affected | CNA |
| Red Hat | Red Hat build of Apache Camel 4 for Quarkus 3 | — | — | Not affected | CNA |
| Red Hat | Red Hat build of Apache Camel for Spring Boot 3 | — | — | Not affected | CNA |
| Red Hat | Red Hat build of Apache Camel for Spring Boot 4 | — | — | No fix listed | CNA |
| Red Hat | Red Hat build of Apicurio Registry 2 | — | — | Not affected | CNA |
| Red Hat | Red Hat Build of Keycloak | — | — | Not affected | CNA |
| Red Hat | Red Hat build of OptaPlanner 8 | — | — | Not affected | CNA |
| Red Hat | Red Hat build of Quarkus | — | — | Not affected | CNA |
| Red Hat | Red Hat build of Quarkus | — | — | Not affected | CNA |
| Red Hat | Red Hat Data Grid 8 | — | — | Not affected | CNA |
| Red Hat | Red Hat Integration Camel K 1 | — | — | Not affected | CNA |
| Red Hat | Red Hat Integration Camel Quarkus 2 | — | — | Not affected | CNA |
| Red Hat | Red Hat JBoss Data Grid 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | — | — | Not affected | CNA |
| Red Hat | Red Hat JBoss Fuse Service Works 6 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Process Automation 7 | — | — | No fix listed | CNA |
| Red Hat | streams for Apache Kafka | — | — | Not affected | CNA |
| — | io.undertow:undertow-core (Maven) | 2.3.0.Final to before 2.3.12.Final | 2.3.12.Final | Patch available | GHSA-w6qf-42m7-vh68 |
| — | io.undertow:undertow-core (Maven) | before 2.2.31.Final | 2.2.31.Final | Patch available | GHSA-w6qf-42m7-vh68 |
- undertow Vendor— Affected 1.31.0 Fixed in — No fix listed CNA
- Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Fuse 7.13.0 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 1.5.5.016-1.redhat_00001.1.ep7.el7 Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 1:1.5.5.016-1.redhat_00001.1.ep7.el7 Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 3.5.11-1.Final_redhat_00001.1.ep7.el7 Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 1.14.2-1.redhat_00002.1.ep7.el7 Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 1.4.18-14.SP13_redhat_00001.1.ep7.el7 Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 7.1.10-2.GA_redhat_00002.1.ep7.el7 Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 5.0.3-2.redhat_00002.1.ep7.el7 Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 2.0.10-2.redhat_00002.1.ep7.el7 Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 2.10.4-3.redhat_00006.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 2.10.4-3.redhat_00006.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 2.10.4-5.redhat_00006.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 2.10.4-3.redhat_00006.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 2.10.4-5.redhat_00006.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 2.10.4-2.redhat_00006.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 1.7.2-16.Final_redhat_00017.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 4.1.63-5.Final_redhat_00003.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 2.0.41-4.SP5_redhat_00001.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 7.3.14-3.GA_redhat_00002.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 1.10.17-1.Final_redhat_00001.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4.16 VendorRed Hat Affected — Fixed in 2.2.30.SP1-redhat-00001 Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 2.2.30-1.SP1_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 2.2.30-1.SP1_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 VendorRed Hat Affected — Fixed in 2.2.30-1.SP1_redhat_00001.1.el7eap Patch available CNA
- Red Hat Single Sign-On 7.6 for RHEL 7 VendorRed Hat Affected — Fixed in 18.0.13-1.redhat_00001.1.el7sso Patch available CNA
- Red Hat Single Sign-On 7.6 for RHEL 8 VendorRed Hat Affected — Fixed in 18.0.13-1.redhat_00001.1.el8sso Patch available CNA
- Red Hat Single Sign-On 7.6 for RHEL 9 VendorRed Hat Affected — Fixed in 18.0.13-1.redhat_00001.1.el9sso Patch available CNA
- RHEL-8 based Middleware Containers VendorRed Hat Affected — Fixed in 7.6-46 Patch available CNA
- RHSSO 7.6.8 VendorRed Hat Affected — Fixed in — Not affected CNA
- OpenShift Serverless VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat build of Apache Camel 4 for Quarkus 3 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat build of Apache Camel for Spring Boot 3 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat build of Apache Camel for Spring Boot 4 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat build of Apicurio Registry 2 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Build of Keycloak VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat build of OptaPlanner 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat build of Quarkus VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat build of Quarkus VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Data Grid 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Integration Camel K 1 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Integration Camel Quarkus 2 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat JBoss Data Grid 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat JBoss Enterprise Application Platform 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat JBoss Fuse Service Works 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Process Automation 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- streams for Apache Kafka VendorRed Hat Affected — Fixed in — Not affected CNA
- io.undertow:undertow-core (Maven) Vendor— Affected 2.3.0.Final to before 2.3.12.Final Fixed in 2.3.12.Final Patch available GHSA-w6qf-42m7-vh68
- io.undertow:undertow-core (Maven) Vendor— Affected before 2.2.31.Final Fixed in 2.2.31.Final Patch available GHSA-w6qf-42m7-vh68
CPE configurations NVD · 15
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:redhat:fuse:1.0:*:*:*:*:*:*:* | 1.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:integration_camel_for_spring_boot:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:* | 7.4 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform:4.11:*:*:*:*:*:*:* | 4.11 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform:4.12:*:*:*:*:*:*:* | 4.12 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.9:*:*:*:*:*:*:* | 4.9 | Vulnerable | Red Hat |
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:redhat:fuse:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:integration_camel_for_spring_boot:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform:4.11:*:*:*:*:*:*:* Versions 4.11 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform:4.12:*:*:*:*:*:*:* Versions 4.12 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.9:*:*:*:*:*:*:* Versions 4.9 Vulnerable ·Red Hat
Show 5 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.10:*:*:*:*:*:*:* | 4.10 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform_for_power:4.9:*:*:*:*:*:*:* | 4.9 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform_for_power:4.10:*:*:*:*:*:*:* | 4.10 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:single_sign-on:7.6:*:*:*:*:*:*:* | 7.6 | Vulnerable | Red Hat |
- cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.10:*:*:*:*:*:*:* Versions 4.10 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform_for_power:4.9:*:*:*:*:*:*:* Versions 4.9 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform_for_power:4.10:*:*:*:*:*:*:* Versions 4.10 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:single_sign-on:7.6:*:*:*:*:*:*:* Versions 7.6 Vulnerable ·Red Hat
Remediation
- Fix · GHSA-w6qf-42m7-vh68 io.undertow:undertow-core (Maven) Fixed in 2.3.12.Final Advisory →
- Fix · GHSA-w6qf-42m7-vh68 io.undertow:undertow-core (Maven) Fixed in 2.2.31.Final Advisory →
Red Hat 13 advisories
- RHSA-2025:9583 Released 2025-06-25 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.3.14 Security update
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-jackson-annotations-2.10.4-3.redhat_00006.1.el7eap, eap7-jackson-core-2.10.4-3.redhat_00006.1.el7eap, eap7-jackson-databind-2.10.4-5.redhat_00006.1.el7eap +40
- RHSA-2025:4226 Released 2025-04-28 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.1.10 on RHEL 7 security update
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-activemq-artemis-1.5.5.016-1.redhat_00001.1.ep7.el7, eap7-activemq-artemis-cli-1.5.5.016-1.redhat_00001.1.ep7.el7, eap7-activemq-artemis-commons-1.5.5.016-1.redhat_00001.1.ep7.el7 +22
- RHSA-2024:4884 Released 2024-07-25 · Red Hat rating ImportantRed Hat Build of Apache Camel 4.4.1 for Spring Boot security update.
- Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2
Show 10 more Red Hat advisories
- RHSA-2024:3354 Released 2024-05-23 · Red Hat rating ImportantRed Hat Fuse 7.13.0 release and security update
- Red Hat Fuse 7.13.0
- RHSA-2024:1866 Released 2024-04-16 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.8 security update
- RHSSO 7.6.8
- RHSA-2024:1862 Released 2024-04-16 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.8 security update on RHEL 9
- Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak-18.0.13-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server-18.0.13-1.redhat_00001.1.el9sso
- RHSA-2024:1861 Released 2024-04-16 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.8 security update on RHEL 8
- Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak-18.0.13-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-18.0.13-1.redhat_00001.1.el8sso
- RHSA-2024:1860 Released 2024-04-16 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.8 enhancement and security update on RHEL 7
- Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak-18.0.13-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server-18.0.13-1.redhat_00001.1.el7sso
- RHSA-2024:1864 Released 2024-04-16 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.8 for OpenShift image enhancement and security update
- Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8
- RHSA-2024:1674 Released 2024-04-04 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.16 Security update
- Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-activemq-artemis-2.16.0-18.redhat_00052.1.el7eap, eap7-activemq-artemis-cli-2.16.0-18.redhat_00052.1.el7eap, eap7-activemq-artemis-commons-2.16.0-18.redhat_00052.1.el7eap +47
- RHSA-2024:1675 Released 2024-04-04 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.16 Security update
- Red Hat JBoss EAP 7.4 for RHEL 8 eap7-activemq-artemis-2.16.0-18.redhat_00052.1.el8eap, eap7-activemq-artemis-cli-2.16.0-18.redhat_00052.1.el8eap, eap7-activemq-artemis-commons-2.16.0-18.redhat_00052.1.el8eap +47
- RHSA-2024:1676 Released 2024-04-04 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.16 Security update
- Red Hat JBoss EAP 7.4 for RHEL 9 eap7-activemq-artemis-2.16.0-18.redhat_00052.1.el9eap, eap7-activemq-artemis-cli-2.16.0-18.redhat_00052.1.el9eap, eap7-activemq-artemis-commons-2.16.0-18.redhat_00052.1.el9eap +47
- RHSA-2024:1677 Released 2024-04-04 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.16 Security update
- Red Hat JBoss Enterprise Application Platform 7.4.16 io.undertow.undertow-core-2.2.30.SP1-redhat-00001.jar, org.apache.sshd.sshd-common-2.12.1.redhat-00001.jar, org.jberet.jberet-core-1.3.9.SP3-redhat-00001.jar
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat Process Automation 7 | Affected | No fix planned: Will not fix |
| Red Hat build of Apache Camel for Spring Boot 4 | Affected | No fix yet |
| Middleware Containers for OpenShift | Fixed | RHSA-2024:1864 |
| RHSSO 7.6.8 | Fixed | RHSA-2024:1866 |
| Red Hat Fuse 7.13.0 | Fixed | RHSA-2024:3354 |
| Red Hat JBoss EAP 7.4 for RHEL 7 Server | Fixed | RHSA-2024:1674 |
| Red Hat JBoss EAP 7.4 for RHEL 8 | Fixed | RHSA-2024:1675 |
| Red Hat JBoss EAP 7.4 for RHEL 9 | Fixed | RHSA-2024:1676 |
| Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server | Fixed | RHSA-2025:4226 |
| Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server | Fixed | RHSA-2025:9583 |
| Red Hat JBoss Enterprise Application Platform 7.4.16 | Fixed | RHSA-2024:1677 |
| Red Hat Single Sign-On 7.6 for RHEL 7 Server | Fixed | RHSA-2024:1860 |
| Red Hat Single Sign-On 7.6 for RHEL 8 | Fixed | RHSA-2024:1861 |
| Red Hat Single Sign-On 7.6 for RHEL 9 | Fixed | RHSA-2024:1862 |
| Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2 | Fixed | RHSA-2024:4884 |
Not affected: 16 products
- OpenShift Serverless
- Red Hat Build of Keycloak
- Red Hat Data Grid 8
- Red Hat Integration Camel K 1
- Red Hat Integration Camel Quarkus 2
- Red Hat JBoss EAP 7.4 for RHEL 7 Server
- Red Hat JBoss EAP 7.4 for RHEL 8
- Red Hat JBoss EAP 7.4 for RHEL 9
- Red Hat JBoss Enterprise Application Platform 7.4.16
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat build of Apache Camel 4 for Quarkus 3
- Red Hat build of Apache Camel for Spring Boot 3
- Red Hat build of Apicurio Registry 2
- Red Hat build of OptaPlanner 8
- Red Hat build of Quarkus
- streams for Apache Kafka
Timeline
- 2026-10-02 Threatist record created from CVE-2024-1635
- 2026-10-03 Alias added: GHSA-w6qf-42m7-vh68
- 2026-10-07 Affected versions changed · CNA
- 2026-10-08 Fix available: Red Hat JBoss Enterprise Application Platform 7.4.16 · Red Hat
References
Advisory 17
- RHSA-2024:1674
- RHSA-2024:1675
- RHSA-2024:1676
- RHSA-2024:1677
- RHSA-2024:1860
- RHSA-2024:1861
- RHSA-2024:1862
- RHSA-2024:1864
- RHSA-2024:1866
- RHSA-2024:3354
- RHSA-2024:4884
- RHSA-2025:4226
- RHSA-2025:9583
- https://access.redhat.com/security/cve/CVE-2024-1635
- RHBZ#2264928
- https://nvd.nist.gov/vuln/detail/CVE-2024-1635
- https://security.netapp.com/advisory/ntap-20240322-0007/
More Red Hat Fuse vulnerabilities
- TI-2016-03813 Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember… KEVCVSS 3.1CRITICAL 9.8
- TI-2015-01295 The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows… KEVCVSS 3.1CRITICAL 9.8
- TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
- TI-2017-03645 Deserialization of untrusted data in Apache Log4j CVSS 3.1CRITICAL 9.8
- TI-2018-01175 Code injection in Spring Framework CVSS 3.1CRITICAL 9.8
- TI-2025-11507 Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf CVSS 3.1CRITICAL 9.6
Sources
- CVE-2024-1635 · CVE Program
- CVE-2024-1635 · NVD
- FIRST EPSS
- GHSA-w6qf-42m7-vh68 · GitHub Advisory Database · CC BY 4.0
- CVE-2024-1635 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences