GHSA-xpp6-8r3j-ww43 CVE-2024-5971
Undertow Denial of Service vulnerability
- Severity
- 0.0 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- 2.92%
- Chance of exploitation in the next 30 days. Higher than 87.04% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-674 Uncontrolled Recursion
- Fix
2.3.15.Final- Upgrade io.undertow:undertow-core to this version or later
Description
A vulnerability was found in Undertow, where the chunked response hangs after the body was flushed. The response headers and body were sent but the client would continue waiting as Undertow does not send the expected 0\r\n termination of the chunked response. This results in uncontrolled resource consumption, leaving the server side to a denial of service attack. This happens only with Java 17 TLSv1.3 scenarios.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| io.undertow:undertow-core | >= 2.3.0.Alpha1, < 2.3.15.Final |
2.3.15.Final |
| io.undertow:undertow-core | < 2.2.34.Final |
2.2.34.Final |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
io.undertow:undertow-core Maven → 2.3.15.Final
- maven
<dependency><groupId>io.undertow</groupId><artifactId>undertow-core</artifactId><version>2.3.15.Final</version></dependency>- gradle
implementation("io.undertow:undertow-core:2.3.15.Final")
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- High
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-674: Uncontrolled Recursion
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
How to prevent it
- Implementation: Ensure that an end condition will be reached under all logic conditions. The end condition may include checking against the depth of recursion and exiting with an error if the recursion goes too deep. The complexity of the end condition contributes to the effectiveness of this action.
- Implementation: Increase the stack size.
References
Advisories
Packages
Other links
- github.com/undertow-io/undertow/pull/1638
- github.com/undertow-io/undertow/pull/1640
- github.com/undertow-io/undertow/pull/1641
- access.redhat.com/errata/RHSA-2024:4392
- access.redhat.com/errata/RHSA-2024:4884
- access.redhat.com/errata/RHSA-2024:5143
- access.redhat.com/errata/RHSA-2024:5144
- access.redhat.com/errata/RHSA-2024:5145
- access.redhat.com/errata/RHSA-2024:5147
- access.redhat.com/errata/RHSA-2024:6508
- access.redhat.com/errata/RHSA-2024:6883
- access.redhat.com/security/cve/CVE-2024-5971
- bugzilla.redhat.com/show_bug.cgi
- issues.redhat.com/browse/UNDERTOW-2413
- security.netapp.com/advisory/ntap-20240828-0001
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-3x3v-w654-m28m Undertow: Denial of Service via Multipart/Form-Data Parsing on HTTP GET Requests | Medium | Also affects io.undertow:undertow-core |
| GHSA-33hj-rcmx-86mv Undertow Servlets Vulnerable to Remote DoS via OutOfMemoryError when Passed Large Parameter Names | High | Also affects io.undertow:undertow-core |
| GHSA-j382-5jj3-vw4j Undertow HTTP server core doesn't properly validate the Host header in incoming HTTP requests | Critical | Also affects io.undertow:undertow-core |
| GHSA-6h4f-pj3g-q8fq Undertow OutOfMemory when parsing form data encoding with application/x-www-form-urlencoded | High | Also affects io.undertow:undertow-core |
| GHSA-95h4-w6j8-2rp8 Undertow MadeYouReset HTTP/2 DDoS Vulnerability | High | Also affects io.undertow:undertow-core |
| GHSA-3jrv-jgp8-45v3 Undertow incorrectly parses cookies | High | Also affects io.undertow:undertow-core |
| GHSA-97cq-f4jm-mv8h Undertow Denial of Service vulnerability | High | Also affects io.undertow:undertow-core |
| GHSA-9623-mqmm-5rcf Undertow vulnerable to Race Condition | High | Also affects io.undertow:undertow-core |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor