Undertow: url-encoded request path information can be broken on ajp-listener
Priority MEDIUM 42CWE-488Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 3 fixed, 7 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
A vulnerability was found in Undertow, where URL-encoded request paths can be mishandled during concurrent requests on the AJP listener. This issue arises because the same buffer is used to decode the paths for multiple requests simultaneously, leading to incorrect path information being processed. As a result, the server may attempt to access the wrong path, causing errors such as "404 Not Found" or other application failures. This flaw can potentially lead to a denial of service, as legitimate resources become inaccessible due to the path mix-up.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01702 77th percentileScored 2026-11-07
Fix Partial undertow: 2.2.33.Final, 2.3.14io.undertow:undertow-core (Maven): 2.3.14.Final, 2.2.33.FinalRed Hat: 2 advisoriesRed Hat: 3 fixed, 7 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | undertow | before 2.2.33.Final; 2.3.0.Alpha1 to before 2.3.14 | 2.2.33.Final, 2.3.14 | Patch available | CNA |
| Red Hat | EAP 8.0.1 | — | — | Not affected | CNA |
| Red Hat | Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2 | — | — | Not affected | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — | — | Not affected | CNA |
| Red Hat | Red Hat build of Apache Camel for Spring Boot 3 | — | — | No fix listed | CNA |
| Red Hat | Red Hat build of Apache Camel - HawtIO 4 | — | — | Not affected | CNA |
| Red Hat | Red Hat Build of Keycloak | — | — | Not affected | CNA |
| Red Hat | Red Hat Data Grid 8 | — | — | Not affected | CNA |
| Red Hat | Red Hat Fuse 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Integration Camel K 1 | — | — | No fix listed | CNA |
| Red Hat | Red Hat JBoss Data Grid 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | — | — | Not affected | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | — | — | Not affected | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — | — | No fix listed | CNA |
| Red Hat | Red Hat Process Automation 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Single Sign-On 7 | — | — | No fix listed | CNA |
| — | io.undertow:undertow-core (Maven) | 2.3.0.Alpha1 to before 2.3.14.Final | 2.3.14.Final | Patch available | GHSA-9442-gm4v-r222 |
| — | io.undertow:undertow-core (Maven) | before 2.2.33.Final | 2.2.33.Final | Patch available | GHSA-9442-gm4v-r222 |
- undertow Vendor— Affected before 2.2.33.Final; 2.3.0.Alpha1 to before 2.3.14 Fixed in 2.2.33.Final, 2.3.14 Patch available CNA
- EAP 8.0.1 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat JBoss Enterprise Application Platform Expansion Pack VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat build of Apache Camel for Spring Boot 3 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat build of Apache Camel - HawtIO 4 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Build of Keycloak VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Data Grid 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Fuse 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Integration Camel K 1 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat JBoss Data Grid 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat JBoss Enterprise Application Platform 7 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat JBoss Enterprise Application Platform 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat JBoss Enterprise Application Platform Expansion Pack VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Process Automation 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Single Sign-On 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- io.undertow:undertow-core (Maven) Vendor— Affected 2.3.0.Alpha1 to before 2.3.14.Final Fixed in 2.3.14.Final Patch available GHSA-9442-gm4v-r222
- io.undertow:undertow-core (Maven) Vendor— Affected before 2.2.33.Final Fixed in 2.2.33.Final Patch available GHSA-9442-gm4v-r222
CPE names CNA · 14
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:jboss_enterprise_application_platform:8.0 | 8.0 | — | Red Hat |
| cpe:/a:redhat:apache_camel_spring_boot:4.4::el6 | 4.4 | — | Red Hat |
| cpe:/a:redhat:jbosseapxp | — | — | Red Hat |
| cpe:/a:redhat:camel_spring_boot:3 | 3 | — | Red Hat |
| cpe:/a:redhat:apache_camel_hawtio:4 | 4 | — | Red Hat |
| cpe:/a:redhat:build_keycloak: | — | — | Red Hat |
| cpe:/a:redhat:jboss_data_grid:8 | 8 | — | Red Hat |
| cpe:/a:redhat:jboss_fuse:7 | 7 | — | Red Hat |
| cpe:/a:redhat:integration:1 | 1 | — | Red Hat |
| cpe:/a:redhat:jboss_data_grid:7 | 7 | — | Red Hat |
- cpe:/a:redhat:jboss_enterprise_application_platform:8.0 Versions 8.0 — ·Red Hat
- cpe:/a:redhat:apache_camel_spring_boot:4.4::el6 Versions 4.4 — ·Red Hat
- cpe:/a:redhat:jbosseapxp Versions — — ·Red Hat
- cpe:/a:redhat:camel_spring_boot:3 Versions 3 — ·Red Hat
- cpe:/a:redhat:apache_camel_hawtio:4 Versions 4 — ·Red Hat
- cpe:/a:redhat:build_keycloak: Versions — — ·Red Hat
- cpe:/a:redhat:jboss_data_grid:8 Versions 8 — ·Red Hat
- cpe:/a:redhat:jboss_fuse:7 Versions 7 — ·Red Hat
- cpe:/a:redhat:integration:1 Versions 1 — ·Red Hat
- cpe:/a:redhat:jboss_data_grid:7 Versions 7 — ·Red Hat
Remediation
- Fix · CNA undertow Fixed in 2.2.33.Final, 2.3.14
- Fix · GHSA-9442-gm4v-r222 io.undertow:undertow-core (Maven) Fixed in 2.3.14.Final Advisory →
- Fix · GHSA-9442-gm4v-r222 io.undertow:undertow-core (Maven) Fixed in 2.2.33.Final Advisory →
Red Hat 2 advisories
- RHSA-2024:4884 Released 2024-07-25 · Red Hat rating ImportantRed Hat Build of Apache Camel 4.4.1 for Spring Boot security update.
- Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2
- RHSA-2024:1194 Released 2024-03-06 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 8.0.1 security update
- EAP 8.0.1
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat Integration Camel K 1 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet |
| Red Hat Process Automation 7 | Affected | No fix planned: Will not fix |
| Red Hat Single Sign-On 7 | Affected | No fix planned: Will not fix |
| Red Hat build of Apache Camel for Spring Boot 3 | Affected | No fix planned: Will not fix |
| EAP 8.0.1 | Fixed | RHSA-2024:1194 |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Fixed | RHSA-2024:4386 |
| Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2 | Fixed | RHSA-2024:4884 |
Not affected: 5 products
- Red Hat Build of Keycloak
- Red Hat Data Grid 8
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat build of Apache Camel - HawtIO 4
Timeline
- 2026-10-02 Threatist record created from CVE-2024-6162
- 2026-10-03 Alias added: GHSA-9442-gm4v-r222
References
Other 11
- https://access.redhat.com/security/cve/CVE-2024-6162
- RHBZ#2293069
- https://issues.redhat.com/browse/JBEAP-26268
- https://github.com/undertow-io/undertow/pull/1612
- https://github.com/undertow-io/undertow/commit/90f202ada89b6d9883beed0f1fe10c99d470d9a8
- https://github.com/undertow-io/undertow/commit/a28ac53076e2fa532266d25e0c0b1a01d0e9d2cf
- https://github.com/undertow-io/undertow
- https://github.com/undertow-io/undertow/releases/tag/2.2.33.Final
- https://github.com/undertow-io/undertow/releases/tag/2.3.14.Final
- https://issues.redhat.com/browse/UNDERTOW-2334
- https://security.netapp.com/advisory/ntap-20241129-0009
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2024-6162 · CVE Program
- CVE-2024-6162 · NVD
- FIRST EPSS
- GHSA-9442-gm4v-r222 · GitHub Advisory Database · CC BY 4.0
- CVE-2024-6162 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences