CVE-2024-3653
mediumpriority · track · 1EPSS 0.019 · 79 %ileDEEUUSEPSS · scored 2026-10-27
A vulnerability was found in Undertow. This issue requires enabling the learning-push handler in the server's config, which is disabled by default, leaving the maxAge config in the handler unconfigured. The default is -1, which makes the handler vulnerable. If someone overwrites that config, the server is not subject to the attack. The attacker needs to be able to reach the server with a normal HTTP request.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (12)
Products and version ranges known to be affected.
- Red Hat JBoss Enterprise Application Platform 7.1.0all versionscert_bundDEcpe:/a:redhat:jboss_enterprise_application_platform:7.1.0
- Red Hat JBoss Enterprise Application Platform 7.4all versionscert_bundDEcpe:/a:redhat:jboss_enterprise_application_platform:7.4
- Red Hat JBoss Enterprise Application Platform 8all versionscert_bundDEcpe:/a:redhat:jboss_enterprise_application_platform:8
- Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8< 0:2.2.33-1.SP1_redhat_00001.1.el8eapenisa_euvdEU
- Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9< 0:2.2.33-1.SP1_redhat_00001.1.el9eapenisa_euvdEU
- Red Hat Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7< 0:2.2.33-1.SP1_redhat_00001.1.el7eapenisa_euvdEU
advisories (2)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2024-2206Red Hat JBoss Enterprise Anwendungsplattform: Mehrere Schwachstellen ermöglichen Denial of ServiceDeutsch2024-09-23csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat JBoss Enterprise Application Platform ausnutzen, um einen Denial of Service Angriff durchzuführen.
- GHSA-ch7q-gpff-h9hpUndertow Missing Release of Memory after Effective Lifetime vulnerability2024-07-09ghsa · osvUS
A vulnerability was found in Undertow. This issue requires enabling the learning-push handler in the server's config, which is disabled by default, leaving the maxAge config in the handler unconfigured. The default is -1, which makes the handler vulnerable. If someone overwrites that config, the server is not subject to the attack. The attacker needs to be able to reach the server with a normal HTTP request.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (22)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/CVE-2024-3653cnnvd
- https://access.redhat.com/security/cve/cve-2024-3653cnnvd
- https://bugzilla.redhat.com/show_bug.cgi?id=2274437cnnvd
- https://cxsecurity.com/cveshow/CVE-2024-3653/cnnvd
- https://vigilance.fr/vulnerability/Undertow-memory-leak-via-LearningPushHandler-44680cnnvd
- https://access.redhat.com/errata/RHSA-2024:4392enisa_euvd
- https://access.redhat.com/errata/RHSA-2024:5143enisa_euvd
- https://access.redhat.com/errata/RHSA-2024:5144enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan