CVE-2024-6162: Undertow: url-encoded request path information can be broken on ajp-listener

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-06-20 · updated 2026-06-17
Weakness: CWE-488

Description

A vulnerability was found in Undertow, where URL-encoded request paths can be mishandled during concurrent requests on the AJP listener. This issue arises because the same buffer is used to decode the paths for multiple requests simultaneously, leading to incorrect path information being processed. As a result, the server may attempt to access the wrong path, causing errors such as "404 Not Found" or other application failures. This flaw can potentially lead to a denial of service, as legitimate resources become inaccessible due to the path mix-up.

Affected products

Red Hat build of Apache Camel for Spring Boot 3: all versions
Red Hat Fuse 7: all versions
Red Hat Integration Camel K 1: all versions
Red Hat JBoss Data Grid 7: all versions
Red Hat JBoss Enterprise Application Platform Expansion Pack: all versions
Red Hat Process Automation 7: all versions
Red Hat Single Sign-On 7: all versions

References

Get alerted when CVE-2024-6162 or the next vulnerability affects your stack