CVE-2023-1108: Undertow: infinite loop in sslconduit during close

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-09-14 · updated 2026-06-17
Weakness: CWE-835

Description

A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates.

Affected products

NetApp OnCommand Workflow Automation: all versions
Red Hat build of Quarkus: all versions
RedHat Decision Manager: 7.0
Red Hat Fuse: 1.0.0
RedHat Integration Camel K: all versions
RedHat Integration Service Registry: all versions
Red Hat JBoss EAP: 7.4
RedHat Jboss Enterprise Application Platform Expansion Pack: all versions
RedHat Openshift Application Runtimes: all versions
Red Hat OpenShift Container Platform 4.18: 4.11, 4.12
RedHat Openshift Container Platform For Linuxone: 4.9, 4.10
RedHat Openshift Container Platform For Power: 4.9, 4.10
nova_libvirt container provided by the Red Hat OpenStack Platform: 13.0
RedHat Process Automation: 7.0
Red Hat Single Sign-On: 7.6
Red Hat undertow: before 2.2.24; from 2.3.0 before 2.3.5 — fixed in 2.2.24, 2.3.5

How to fix

Upgrade to a fixed version: Red Hat undertow 2.2.24, 2.3.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-1108 or the next vulnerability affects your stack