CVE-2024-3653: Undertow: learningpushhandler can lead to remote memory dos attacks

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-07-08 · updated 2026-09-08
Weakness: CWE-401

Description

A vulnerability was found in Undertow. This issue requires enabling the learning-push handler in the server's config, which is disabled by default, leaving the maxAge config in the handler unconfigured. The default is -1, which makes the handler vulnerable. If someone overwrites that config, the server is not subject to the attack. The attacker needs to be able to reach the server with a normal HTTP request.

Affected products

Red Hat OpenShift Serverless: all versions
Red Hat build of Apache Camel 4 for Quarkus 3: all versions
Red Hat build of Apache Camel for Spring Boot 4: all versions
Red Hat build of OptaPlanner 8: all versions
Red Hat build of Quarkus 3.8.6.redhat: all versions — fixed in 5.2.4.redhat-00001
Red Hat Data Grid 8: all versions
Red Hat Integration Camel K 1: all versions
Red Hat Integration Camel Quarkus 2: all versions
Red Hat JBoss Enterprise Application Platform: all versions — fixed in 2.2.33.SP1-redhat-00001
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8: all versions — fixed in 0:2.2.33-1.SP1_redhat_00001.1.el8eap
Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9: all versions — fixed in 0:2.2.33-1.SP1_redhat_00001.1.el9eap
Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7: all versions — fixed in 0:2.2.33-1.SP1_redhat_00001.1.el7eap
Red Hat Single Sign-On 7: all versions
Red Hat streams for Apache Kafka: all versions

How to fix

Upgrade to a fixed version: Red Hat build of Quarkus 3.8.6.redhat 5.2.4.redhat-00001; Red Hat JBoss Enterprise Application Platform 2.2.33.SP1-redhat-00001; Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 0:2.2.33-1.SP1_redhat_00001.1.el8eap; Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 0:2.2.33-1.SP1_redhat_00001.1.el9eap; Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 0:2.2.33-1.SP1_redhat_00001.1.el7eap. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-3653 or the next vulnerability affects your stack