Undertow: improper state management in proxy protocol parsing causes information leakage
Priority LOW 38CWE-362Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 12 fixed, 8 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a result, different requests may share the same StringBuilder instance, potentially leading to information leakage between requests or responses. In some cases, a value from a previous request or response may be erroneously reused, which could lead to unintended data exposure. This issue primarily results in errors and connection termination but creates a risk of data leakage in multi-request environments.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02644 85th percentileScored 2026-11-07
Fix Partial undertow: 2.2.36.Final, 2.3.17.Finalio.undertow:undertow-core (Maven): 2.2.36.Final, 2.3.17.FinalRed Hat: 10 advisoriesRed Hat: 12 fixed, 8 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | undertow | before 2.2.36.Final; 2.3.0.Alpha1 to before 2.3.17.Final | 2.2.36.Final, 2.3.17.Final | Patch available | CNA |
| Red Hat | HawtIO 4.0.0 for Red Hat build of Apache Camel 4 | — | — | Not affected | CNA |
| Red Hat | Red Hat build of Apache Camel 3.20.7 for Spring Boot | — | — | Not affected | CNA |
| Red Hat | Red Hat build of Apache Camel 4.4.2 for Spring Boot | — | — | Not affected | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform | — | 2.2.33.SP2-redhat-00001 | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | — | — | Not affected | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | — | 1.11.0-1.redhat_00001.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | — | 2.4.11-1.Final_redhat_00001.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | — | 1.7.2-19.Final_redhat_00020.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | — | 2.0.41-5.SP6_redhat_00001.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | — | 7.3.15-5.GA_redhat_00003.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | — | 2.10.4-4.redhat_00008.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | — | 2.10.4-4.redhat_00008.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | — | 2.10.4-6.redhat_00008.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | — | 2.10.4-4.redhat_00008.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | — | 2.10.4-6.redhat_00008.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | — | 2.10.4-3.redhat_00008.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | — | 1.7.2-20.Final_redhat_00021.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | — | 4.1.63-6.Final_redhat_00004.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | — | 2.0.41-6.SP7_redhat_00001.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 | — | 7.3.16-3.GA_redhat_00003.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 2.2.33-2.SP2_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 | — | 7.4.18-1.GA_redhat_00003.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 2.2.33-2.SP2_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 | — | 7.4.18-1.GA_redhat_00003.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | — | 2.2.33-2.SP2_redhat_00001.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 | — | 7.4.18-1.GA_redhat_00003.1.el7eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | — | — | Not affected | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | — | 1.11.9-2.redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | — | 800.3.1-2.GA_redhat_00002.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | — | 2.3.14-2.SP2_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | — | 8.0.3-13.GA_redhat_00007.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | — | 1.11.9-2.redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | — | 800.3.1-2.GA_redhat_00002.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | — | 2.3.14-2.SP2_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | — | 8.0.3-13.GA_redhat_00007.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat build of Apache Camel for Spring Boot 3 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Build of Keycloak | — | — | No fix listed | CNA |
| Red Hat | Red Hat build of Quarkus | — | — | Not affected | CNA |
| Red Hat | Red Hat Data Grid 8 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Fuse 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Integration Camel K 1 | — | — | No fix listed | CNA |
| Red Hat | Red Hat JBoss Data Grid 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | — | — | Not affected | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — | — | Not affected | CNA |
| Red Hat | Red Hat Process Automation 7 | — | — | No fix listed | CNA |
| Red Hat | Red Hat Single Sign-On 7 | — | — | No fix listed | CNA |
| — | io.undertow:undertow-core (Maven) | before 2.2.36.Final | 2.2.36.Final | Patch available | GHSA-9623-mqmm-5rcf |
| — | io.undertow:undertow-core (Maven) | 2.3.0.Alpha1 to before 2.3.17.Final | 2.3.17.Final | Patch available | GHSA-9623-mqmm-5rcf |
- undertow Vendor— Affected before 2.2.36.Final; 2.3.0.Alpha1 to before 2.3.17.Final Fixed in 2.2.36.Final, 2.3.17.Final Patch available CNA
- HawtIO 4.0.0 for Red Hat build of Apache Camel 4 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat build of Apache Camel 3.20.7 for Spring Boot VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat build of Apache Camel 4.4.2 for Spring Boot VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat JBoss Enterprise Application Platform VendorRed Hat Affected — Fixed in 2.2.33.SP2-redhat-00001 Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 1.11.0-1.redhat_00001.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 2.4.11-1.Final_redhat_00001.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 1.7.2-19.Final_redhat_00020.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 2.0.41-5.SP6_redhat_00001.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 7.3.15-5.GA_redhat_00003.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 2.10.4-4.redhat_00008.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 2.10.4-4.redhat_00008.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 2.10.4-6.redhat_00008.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 2.10.4-4.redhat_00008.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 2.10.4-6.redhat_00008.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 2.10.4-3.redhat_00008.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 1.7.2-20.Final_redhat_00021.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 4.1.63-6.Final_redhat_00004.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 2.0.41-6.SP7_redhat_00001.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 VendorRed Hat Affected — Fixed in 7.3.16-3.GA_redhat_00003.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 2.2.33-2.SP2_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 VendorRed Hat Affected — Fixed in 7.4.18-1.GA_redhat_00003.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 2.2.33-2.SP2_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 VendorRed Hat Affected — Fixed in 7.4.18-1.GA_redhat_00003.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 VendorRed Hat Affected — Fixed in 2.2.33-2.SP2_redhat_00001.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 VendorRed Hat Affected — Fixed in 7.4.18-1.GA_redhat_00003.1.el7eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 VendorRed Hat Affected — Fixed in 1.11.9-2.redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 VendorRed Hat Affected — Fixed in 800.3.1-2.GA_redhat_00002.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 VendorRed Hat Affected — Fixed in 2.3.14-2.SP2_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 VendorRed Hat Affected — Fixed in 8.0.3-13.GA_redhat_00007.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 VendorRed Hat Affected — Fixed in 1.11.9-2.redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 VendorRed Hat Affected — Fixed in 800.3.1-2.GA_redhat_00002.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 VendorRed Hat Affected — Fixed in 2.3.14-2.SP2_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 VendorRed Hat Affected — Fixed in 8.0.3-13.GA_redhat_00007.1.el9eap Patch available CNA
- Red Hat build of Apache Camel for Spring Boot 3 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Build of Keycloak VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat build of Quarkus VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Data Grid 8 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Fuse 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Integration Camel K 1 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat JBoss Data Grid 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat JBoss Enterprise Application Platform 7 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat JBoss Enterprise Application Platform Expansion Pack VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Process Automation 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat Single Sign-On 7 VendorRed Hat Affected — Fixed in — No fix listed CNA
- io.undertow:undertow-core (Maven) Vendor— Affected before 2.2.36.Final Fixed in 2.2.36.Final Patch available GHSA-9623-mqmm-5rcf
- io.undertow:undertow-core (Maven) Vendor— Affected 2.3.0.Alpha1 to before 2.3.17.Final Fixed in 2.3.17.Final Patch available GHSA-9623-mqmm-5rcf
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:build_of_apache_camel_-_hawtio:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:build_of_apache_camel_for_spring_boot:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:data_grid:8.0.0:*:*:*:*:*:*:* | 8.0.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:integration_camel_k:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:* | 7.0.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:8.0.0:*:*:*:*:*:*:* | 8.0.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:* | 7.0.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
- cpe:2.3:a:redhat:build_of_apache_camel_-_hawtio:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:build_of_apache_camel_for_spring_boot:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:data_grid:8.0.0:*:*:*:*:*:*:* Versions 8.0.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:integration_camel_k:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:8.0.0:*:*:*:*:*:*:* Versions 8.0.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
Remediation
- Fix · CNA undertow Fixed in 2.2.36.Final, 2.3.17.Final
- Fix · GHSA-9623-mqmm-5rcf io.undertow:undertow-core (Maven) Fixed in 2.2.36.Final Advisory →
- Fix · GHSA-9623-mqmm-5rcf io.undertow:undertow-core (Maven) Fixed in 2.3.17.Final Advisory →
Red Hat 10 advisories
- RHSA-2026:0743 Released 2026-01-19 · Red Hat rating CriticalRed Hat JBoss Enterprise Application Platform 7.3.16 security update
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-jackson-annotations-2.10.4-4.redhat_00008.1.el7eap, eap7-jackson-core-2.10.4-4.redhat_00008.1.el7eap, eap7-jackson-databind-2.10.4-6.redhat_00008.1.el7eap +38
- RHSA-2025:16667 Released 2025-09-25 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.3.15 security update
- Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-apache-commons-beanutils-1.11.0-1.redhat_00001.1.el7eap, eap7-hornetq-2.4.11-1.Final_redhat_00001.1.el7eap, eap7-hornetq-commons-2.4.11-1.Final_redhat_00001.1.el7eap +30
- RHSA-2024:11023 Released 2024-12-12 · Red Hat rating ImportantHawtIO 4.1.0 for Red Hat build of Apache Camel 4 Release and security update.
- HawtIO 4.0.0 for Red Hat build of Apache Camel 4
Show 7 more Red Hat advisories
- RHSA-2024:8080 Released 2024-10-14 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.19 Security update
- Red Hat JBoss Enterprise Application Platform io.undertow.undertow-core-2.2.33.SP2-redhat-00001.jar, org.bitbucket.b_c.jose4j-0.9.3.redhat-00002.pom, org.jsoup.jsoup-1.15.4.redhat-00003.jar +2
- RHSA-2024:7736 Released 2024-10-07 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4 Security update
- Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-undertow-2.2.33-2.SP2_redhat_00001.1.el7eap, eap7-wildfly-7.4.18-1.GA_redhat_00003.1.el7eap, eap7-wildfly-java-jdk11-7.4.18-1.GA_redhat_00003.1.el7eap +3
- Red Hat JBoss EAP 7.4 for RHEL 8 eap7-undertow-2.2.33-2.SP2_redhat_00001.1.el8eap, eap7-wildfly-7.4.18-1.GA_redhat_00003.1.el8eap, eap7-wildfly-java-jdk11-7.4.18-1.GA_redhat_00003.1.el8eap +4
- Red Hat JBoss EAP 7.4 for RHEL 9 eap7-undertow-2.2.33-2.SP2_redhat_00001.1.el9eap, eap7-wildfly-7.4.18-1.GA_redhat_00003.1.el9eap, eap7-wildfly-java-jdk11-7.4.18-1.GA_redhat_00003.1.el9eap +4
- RHSA-2024:7735 Released 2024-10-07 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4 security update
- Red Hat JBoss Enterprise Application Platform 7
- RHSA-2024:7441 Released 2024-10-01 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 8.0 security update
- Red Hat JBoss EAP 8.0 for RHEL 8 eap8-amazon-ion-java-1.11.9-2.redhat_00001.1.el8eap, eap8-eap-product-conf-parent-800.3.1-2.GA_redhat_00002.1.el8eap, eap8-eap-product-conf-wildfly-ee-feature-pack-800.3.1-2.GA_redhat_00002.1.el8eap +6
- Red Hat JBoss EAP 8.0 for RHEL 9 eap8-amazon-ion-java-1.11.9-2.redhat_00001.1.el9eap, eap8-eap-product-conf-parent-800.3.1-2.GA_redhat_00002.1.el9eap, eap8-eap-product-conf-wildfly-ee-feature-pack-800.3.1-2.GA_redhat_00002.1.el9eap +6
- RHSA-2024:7442 Released 2024-10-01 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 8.0 security update
- Red Hat JBoss Enterprise Application Platform 8
- RHSA-2024:6883 Released 2024-09-19 · Red Hat rating ImportantRed Hat Build of Apache Camel 3.20.7 for Spring Boot security update.
- Red Hat build of Apache Camel 3.20.7 for Spring Boot
- RHSA-2024:6508 Released 2024-09-09 · Red Hat rating ImportantRed Hat Build of Apache Camel 4.4.2 for Spring Boot security update.
- Red Hat build of Apache Camel 4.4.2 for Spring Boot
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Build of Keycloak | Affected | No fix yet |
| Red Hat Data Grid 8 | Affected | No fix planned: Will not fix |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat Integration Camel K 1 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat Process Automation 7 | Affected | No fix planned: Out of support scope |
| Red Hat Single Sign-On 7 | Affected | No fix yet |
| Red Hat build of Apache Camel for Spring Boot 3 | Affected | No fix yet |
| HawtIO 4.0.0 for Red Hat build of Apache Camel 4 | Fixed | RHSA-2024:11023 |
| Red Hat JBoss EAP 7.4 for RHEL 7 Server | Fixed | RHSA-2024:7736 |
| Red Hat JBoss EAP 7.4 for RHEL 8 | Fixed | RHSA-2024:7736 |
| Red Hat JBoss EAP 7.4 for RHEL 9 | Fixed | RHSA-2024:7736 |
| Red Hat JBoss EAP 8.0 for RHEL 8 | Fixed | RHSA-2024:7441 |
| Red Hat JBoss EAP 8.0 for RHEL 9 | Fixed | RHSA-2024:7441 |
| Red Hat JBoss Enterprise Application Platform | Fixed | RHSA-2024:8080 |
| Red Hat JBoss Enterprise Application Platform 7 | Fixed | RHSA-2024:7735 |
| Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server | Fixed | RHSA-2025:16667, RHSA-2026:0743 |
| Red Hat JBoss Enterprise Application Platform 8 | Fixed | RHSA-2024:7442 |
| Red Hat build of Apache Camel 3.20.7 for Spring Boot | Fixed | RHSA-2024:6883 |
| Red Hat build of Apache Camel 4.4.2 for Spring Boot | Fixed | RHSA-2024:6508 |
Not affected: 4 products
- Red Hat JBoss Enterprise Application Platform
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat build of Quarkus
Timeline
- 2026-10-02 Threatist record created from CVE-2024-7885
- 2026-10-03 Alias added: GHSA-9623-mqmm-5rcf
- 2026-11-04 Affected versions changed · CNA
- 2026-11-05 Affected versions changed · Red Hat
References
Advisory 13
Other 5
- https://github.com/undertow-io/undertow/commit/ce5182c37376982ef0abee34fce0d8c0aab0fab8
- https://github.com/undertow-io/undertow/commit/80c125e09068ac52ed0a9acde266ef12f8ed7ae1
- https://security.netapp.com/advisory/ntap-20241011-0004
- https://github.com/undertow-io/undertow/blob/182e4ca1543c52f438b0244c930dca3d8b6e68e3/core/src/main/java/io/undertow/server/protocol/proxy/ProxyProtocolReadListener.java
- https://github.com/undertow-io/undertow
More Red Hat Build Of Apache Camel - Hawtio vulnerabilities
- TI-2026-22645 Undertow: undertow: request smuggling via inconsistent header parsing CVSS 3.1CRITICAL 9.1
- TI-2026-22646 Undertow: undertow: request smuggling via malformed http request headers CVSS 3.1CRITICAL 9.1
- TI-2026-22644 Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator CVSS 3.1CRITICAL 9.1
Sources
- CVE-2024-7885 · CVE Program
- CVE-2024-7885 · NVD
- FIRST EPSS
- GHSA-9623-mqmm-5rcf · GitHub Advisory Database · CC BY 4.0
- CVE-2024-7885 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences