Undertow: response write hangs in case of java 17 tlsv1.3 newsessionticket
Priority MEDIUM 44CWE-674Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 8 fixed, 6 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-674.
Summary
A vulnerability was found in Undertow, where the chunked response hangs after the body was flushed. The response headers and body were sent but the client would continue waiting as Undertow does not send the expected 0\r\n termination of the chunked response. This results in uncontrolled resource consumption, leaving the server side to a denial of service attack. This happens only with Java 17 TLSv1.3 scenarios.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02921 87th percentileScored 2026-11-07
Fix Partial undertow: 2.2.34.Final, 2.3.15.Finalio.undertow:undertow-core (Maven): 2.3.15.Final, 2.2.34.FinalRed Hat: 8 advisoriesRed Hat: 8 fixed, 6 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | undertow | before 2.2.34.Final; 2.3.0.Alpha1 to before 2.3.15.Final | 2.2.34.Final, 2.3.15.Final | Patch available | CNA |
| Red Hat | Red Hat build of Apache Camel 3.20.7 for Spring Boot | — | — | Not affected | CNA |
| Red Hat | Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2 | — | — | Not affected | CNA |
| Red Hat | Red Hat build of Apache Camel 4.4.2 for Spring Boot | — | — | Not affected | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform | — | 2.2.33.SP1-redhat-00001 | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 2.2.33-1.SP1_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 2.2.33-1.SP1_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | — | 2.2.33-1.SP1_redhat_00001.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | — | — | Not affected | CNA |
| Red Hat | Red Hat build of Apache Camel for Spring Boot 3 | — | — | No fix listed | CNA |
| Red Hat | Red Hat build of Apache Camel - HawtIO 4 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Build of Keycloak | — | — | Not affected | CNA |
| Red Hat | Red Hat build of Quarkus | — | — | Not affected | CNA |
| Red Hat | Red Hat Data Grid 8 | — | — | Not affected | CNA |
| Red Hat | Red Hat Fuse 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Integration Camel K 1 | — | — | No fix listed | CNA |
| Red Hat | Red Hat JBoss Data Grid 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | — | — | Not affected | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — | — | Not affected | CNA |
| Red Hat | Red Hat Process Automation 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Single Sign-On 7 | — | — | Not affected | CNA |
| — | io.undertow:undertow-core (Maven) | 2.3.0.Alpha1 to before 2.3.15.Final | 2.3.15.Final | Patch available | GHSA-xpp6-8r3j-ww43 |
| — | io.undertow:undertow-core (Maven) | before 2.2.34.Final | 2.2.34.Final | Patch available | GHSA-xpp6-8r3j-ww43 |
- undertow Vendor— Affected before 2.2.34.Final; 2.3.0.Alpha1 to before 2.3.15.Final Fixed in 2.2.34.Final, 2.3.15.Final Patch available CNA
- Red Hat build of Apache Camel 3.20.7 for Spring Boot VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat build of Apache Camel 4.4.2 for Spring Boot VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat JBoss Enterprise Application Platform VendorRed Hat Affected — Fixed in 2.2.33.SP1-redhat-00001 Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 2.2.33-1.SP1_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 2.2.33-1.SP1_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 VendorRed Hat Affected — Fixed in 2.2.33-1.SP1_redhat_00001.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat build of Apache Camel for Spring Boot 3 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat build of Apache Camel - HawtIO 4 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Build of Keycloak VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat build of Quarkus VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Data Grid 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Fuse 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Integration Camel K 1 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat JBoss Data Grid 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat JBoss Enterprise Application Platform 7 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat JBoss Enterprise Application Platform Expansion Pack VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Process Automation 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Single Sign-On 7 VendorRed Hat Affected — Fixed in — Not affected CNA
- io.undertow:undertow-core (Maven) Vendor— Affected 2.3.0.Alpha1 to before 2.3.15.Final Fixed in 2.3.15.Final Patch available GHSA-xpp6-8r3j-ww43
- io.undertow:undertow-core (Maven) Vendor— Affected before 2.2.34.Final Fixed in 2.2.34.Final Patch available GHSA-xpp6-8r3j-ww43
CPE names CNA · 20
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:apache_camel_spring_boot:3.20.7 | 3.20.7 | — | Red Hat |
| cpe:/a:redhat:apache_camel_spring_boot:4.4::el6 | 4.4 | — | Red Hat |
| cpe:/a:redhat:apache_camel_spring_boot:4.4.2 | 4.4.2 | — | Red Hat |
| cpe:/a:redhat:jboss_enterprise_application_platform:7.4 | 7.4 | — | Red Hat |
| cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8 | 7.4 | — | Red Hat |
| cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9 | 7.4 | — | Red Hat |
| cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7 | 7.4 | — | Red Hat |
| cpe:/a:redhat:jboss_enterprise_application_platform:8.0 | 8.0 | — | Red Hat |
| cpe:/a:redhat:camel_spring_boot:3 | 3 | — | Red Hat |
| cpe:/a:redhat:apache_camel_hawtio:4 | 4 | — | Red Hat |
- cpe:/a:redhat:apache_camel_spring_boot:3.20.7 Versions 3.20.7 — ·Red Hat
- cpe:/a:redhat:apache_camel_spring_boot:4.4::el6 Versions 4.4 — ·Red Hat
- cpe:/a:redhat:apache_camel_spring_boot:4.4.2 Versions 4.4.2 — ·Red Hat
- cpe:/a:redhat:jboss_enterprise_application_platform:7.4 Versions 7.4 — ·Red Hat
- cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8 Versions 7.4 — ·Red Hat
- cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9 Versions 7.4 — ·Red Hat
- cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7 Versions 7.4 — ·Red Hat
- cpe:/a:redhat:jboss_enterprise_application_platform:8.0 Versions 8.0 — ·Red Hat
- cpe:/a:redhat:camel_spring_boot:3 Versions 3 — ·Red Hat
- cpe:/a:redhat:apache_camel_hawtio:4 Versions 4 — ·Red Hat
Show 10 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:build_keycloak: | — | — | Red Hat |
| cpe:/a:redhat:quarkus:3 | 3 | — | Red Hat |
| cpe:/a:redhat:jboss_data_grid:8 | 8 | — | Red Hat |
| cpe:/a:redhat:jboss_fuse:7 | 7 | — | Red Hat |
| cpe:/a:redhat:camel_k:1 | 1 | — | Red Hat |
| cpe:/a:redhat:jboss_data_grid:7 | 7 | — | Red Hat |
| cpe:/a:redhat:jboss_enterprise_application_platform:7 | 7 | — | Red Hat |
| cpe:/a:redhat:jbosseapxp | — | — | Red Hat |
| cpe:/a:redhat:jboss_bpms:7 | 7 | — | Red Hat |
| cpe:/a:redhat:red_hat_single_sign_on:7 | 7 | — | Red Hat |
- cpe:/a:redhat:build_keycloak: Versions — — ·Red Hat
- cpe:/a:redhat:quarkus:3 Versions 3 — ·Red Hat
- cpe:/a:redhat:jboss_data_grid:8 Versions 8 — ·Red Hat
- cpe:/a:redhat:jboss_fuse:7 Versions 7 — ·Red Hat
- cpe:/a:redhat:camel_k:1 Versions 1 — ·Red Hat
- cpe:/a:redhat:jboss_data_grid:7 Versions 7 — ·Red Hat
- cpe:/a:redhat:jboss_enterprise_application_platform:7 Versions 7 — ·Red Hat
- cpe:/a:redhat:jbosseapxp Versions — — ·Red Hat
- cpe:/a:redhat:jboss_bpms:7 Versions 7 — ·Red Hat
- cpe:/a:redhat:red_hat_single_sign_on:7 Versions 7 — ·Red Hat
Remediation
- Fix · CNA undertow Fixed in 2.2.34.Final, 2.3.15.Final
- Fix · GHSA-xpp6-8r3j-ww43 io.undertow:undertow-core (Maven) Fixed in 2.3.15.Final Advisory →
- Fix · GHSA-xpp6-8r3j-ww43 io.undertow:undertow-core (Maven) Fixed in 2.2.34.Final Advisory →
Red Hat 8 advisories
- RHSA-2024:6883 Released 2024-09-19 · Red Hat rating ImportantRed Hat Build of Apache Camel 3.20.7 for Spring Boot security update.
- Red Hat build of Apache Camel 3.20.7 for Spring Boot
- RHSA-2024:6508 Released 2024-09-09 · Red Hat rating ImportantRed Hat Build of Apache Camel 4.4.2 for Spring Boot security update.
- Red Hat build of Apache Camel 4.4.2 for Spring Boot
- RHSA-2024:5147 Released 2024-08-08 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.18 Security update
- Red Hat JBoss Enterprise Application Platform io.netty.netty-codec-http-4.1.108.Final-redhat-00001.jar, io.undertow.undertow-core-2.2.33.SP1-redhat-00001.jar, org.bouncycastle.bcprov-jdk18on-1.78.1.redhat-00002.pom
Show 5 more Red Hat advisories
- RHSA-2024:5144 Released 2024-08-08 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.18 Security update
- Red Hat JBoss EAP 7.4 for RHEL 8 eap7-bouncycastle-1.78.1-1.redhat_00002.1.el8eap, eap7-bouncycastle-mail-1.78.1-1.redhat_00002.1.el8eap, eap7-bouncycastle-pg-1.78.1-1.redhat_00002.1.el8eap +47
- RHSA-2024:5143 Released 2024-08-08 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.18 Security update
- Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-bouncycastle-1.78.1-1.redhat_00002.1.el7eap, eap7-bouncycastle-mail-1.78.1-1.redhat_00002.1.el7eap, eap7-bouncycastle-pg-1.78.1-1.redhat_00002.1.el7eap +47
- RHSA-2024:5145 Released 2024-08-08 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.18 Security update
- Red Hat JBoss EAP 7.4 for RHEL 9 eap7-bouncycastle-1.78.1-1.redhat_00002.1.el9eap, eap7-bouncycastle-mail-1.78.1-1.redhat_00002.1.el9eap, eap7-bouncycastle-pg-1.78.1-1.redhat_00002.1.el9eap +47
- RHSA-2024:4884 Released 2024-07-25 · Red Hat rating ImportantRed Hat Build of Apache Camel 4.4.1 for Spring Boot security update.
- Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2
- RHSA-2024:4392 Released 2024-07-08 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 8.0.2 Security update
- Red Hat JBoss Enterprise Application Platform 8
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Red Hat Build of Keycloak, Red Hat Data Grid 8 and 13 more products — RHSA-2024:4392
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2024-03408 Undertow: learningpushhandler can lead to remote memory dos attacksPriority LOW 34
- Advisory ·
Red Hat Build of Keycloak, Red Hat Data Grid 8 and 13 more products — RHSA-2024:5143
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2024-03408 Undertow: learningpushhandler can lead to remote memory dos attacksPriority LOW 34
Show 3 more groups
- Advisory ·
Red Hat Build of Keycloak, Red Hat Data Grid 8 and 13 more products — RHSA-2024:5144
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2024-03408 Undertow: learningpushhandler can lead to remote memory dos attacksPriority LOW 34
- Advisory ·
Red Hat Build of Keycloak, Red Hat Data Grid 8 and 13 more products — RHSA-2024:5145
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2024-03408 Undertow: learningpushhandler can lead to remote memory dos attacksPriority LOW 34
- Advisory ·
Red Hat Build of Keycloak, Red Hat Data Grid 8 and 13 more products — RHSA-2024:5147
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2024-03408 Undertow: learningpushhandler can lead to remote memory dos attacksPriority LOW 34
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Fuse 7 | Affected | No fix yet |
| Red Hat Integration Camel K 1 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat Process Automation 7 | Affected | No fix planned: Out of support scope |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix yet |
| Red Hat build of Apache Camel for Spring Boot 3 | Affected | No fix yet |
| Red Hat JBoss EAP 7.4 for RHEL 7 Server | Fixed | RHSA-2024:5143 |
| Red Hat JBoss EAP 7.4 for RHEL 8 | Fixed | RHSA-2024:5144 |
| Red Hat JBoss EAP 7.4 for RHEL 9 | Fixed | RHSA-2024:5145 |
| Red Hat JBoss Enterprise Application Platform | Fixed | RHSA-2024:5147 |
| Red Hat JBoss Enterprise Application Platform 8 | Fixed | RHSA-2024:4392 |
| Red Hat build of Apache Camel 3.20.7 for Spring Boot | Fixed | RHSA-2024:6883 |
| Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2 | Fixed | RHSA-2024:4884 |
| Red Hat build of Apache Camel 4.4.2 for Spring Boot | Fixed | RHSA-2024:6508 |
Not affected: 10 products
- Red Hat Build of Keycloak
- Red Hat Data Grid 8
- Red Hat JBoss EAP 7.4 for RHEL 7 Server
- Red Hat JBoss EAP 7.4 for RHEL 8
- Red Hat JBoss EAP 7.4 for RHEL 9
- Red Hat JBoss Enterprise Application Platform
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat Single Sign-On 7
- Red Hat build of Quarkus
Timeline
- 2026-10-02 Threatist record created from CVE-2024-5971
- 2026-10-03 Alias added: GHSA-xpp6-8r3j-ww43
References
Advisory 9
Other 7
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2024-5971 · CVE Program
- CVE-2024-5971 · NVD
- FIRST EPSS
- GHSA-xpp6-8r3j-ww43 · GitHub Advisory Database · CC BY 4.0
- CVE-2024-5971 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences