What’s Vulnerable › Vulnerabilities

CVE-2023-0833: Red hat a-mq streams: component version with information disclosure flaw

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-09-27 · updated 2026-06-23
• Weakness: CWE-209

Description

A flaw was found in Red Hat's AMQ-Streams, which ships a version of the OKHttp component with an information disclosure flaw via an exception triggered by a header containing an illegal value. This issue could allow an authenticated attacker to access information outside of their regular permissions.

Affected products

• RedHat A-Mq Streams: before 2.2.1; from 2.3.0 before 2.4.0 — fixed in 2.2.1, 2.4.0
• Squareup Okhttp: before 4.9.2 — fixed in 4.9.2

How to fix

Upgrade to a fixed version: RedHat A-Mq Streams 2.2.1, 2.4.0; Squareup Okhttp 4.9.2. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2023:1241
• https://access.redhat.com/errata/RHSA-2023:3223
• https://access.redhat.com/security/cve/CVE-2023-0833
• https://bugzilla.redhat.com/show_bug.cgi?id=2169845
• https://github.com/square/okhttp/issues/6738
• https://access.redhat.com/errata/RHSA-2023:1241
• https://access.redhat.com/errata/RHSA-2023:3223
• https://access.redhat.com/security/cve/CVE-2023-0833
• https://bugzilla.redhat.com/show_bug.cgi?id=2169845
• https://github.com/square/okhttp/issues/6738

Get alerted when CVE-2023-0833 or the next vulnerability affects your stack