CVE-2024-5971: Undertow: response write hangs in case of java 17 tlsv1.3 newsessionticket
A vulnerability was found in Undertow, where the chunked response hangs after the body was flushed. The response headers and body were sent but the client would continue waiting as Undertow does not send the expected 0\r\n termination of the chunked response. This results in uncontrolled resource consumption, leaving the server side to a denial of service attack. This happens only with Java 17 TLSv1.3 scenarios.
Other sources
A vulnerability was found in Undertow, where the chunked response hangs after the body was flushed. The response headers and body were sent but the client would continue waiting as Undertow does not send the expected 0\r\n termination of the chunked response. This results in uncontrolled resource consumption, leaving the server side to a denial of service attack. This happens only with Java 17 TLSv1.3 scenarios.
— NVD
A vulnerability was found in Undertow. Undertow chunked response hangs after the body was flushed. The response headers and body were sent but the client would continue waiting as Undertow does not send the expected 0\r\n termination of the chunked response. This results in an uncontrolled resource consumption leaving the server side to a Denial of Service vulnerability attack. This happens only with Java 17 TLSv1.3 scenarios.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/io.undertow:undertow-coreto a version that resolves this vulnerability.Fixed in 2.2.34.Final - Upgrade
Upgrade
maven/io.undertow:undertow-coreto a version that resolves this vulnerability.Fixed in 2.3.15.Final - Upgrade
Upgrade
debian/undertowto a version that resolves this vulnerability.Fixed in 2.3.18-1 - Upgrade
Upgrade
debian/undertowto a version that resolves this vulnerability.Fixed in 2.3.20-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5971?
CVE-2024-5971 is considered a moderate severity vulnerability that can lead to indefinite hanging of client responses.
How do I fix CVE-2024-5971?
To fix CVE-2024-5971, upgrade Undertow to version 2.2.34.Final or to 2.3.15.Final.
What systems are affected by CVE-2024-5971?
CVE-2024-5971 affects Undertow versions prior to 2.2.34.Final and those in the range from 2.3.0.Alpha1 to 2.3.15.Final.
What are the implications of CVE-2024-5971 for my application?
CVE-2024-5971 can cause client applications to hang indefinitely while waiting for responses from the server.
Is CVE-2024-5971 being actively exploited?
As of now, there is no public information indicating that CVE-2024-5971 is being actively exploited in the wild.