REDHAT-BUG-2292211
First published: Thu Jun 13 2024(Updated: )
A vulnerability was found in Undertow. Undertow chunked response hangs after the body was flushed. The response headers and body were sent but the client would continue waiting as Undertow does not send the expected 0\r\n termination of the chunked response. This results in an uncontrolled resource consumption leaving the server side to a Denial of Service vulnerability attack. This happens only with Java 17 TLSv1.3 scenarios.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Undertow |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/errata/RHSA-2024:4392
- https://access.redhat.com/errata/RHSA-2024:4884
- https://access.redhat.com/errata/RHSA-2024:5145
- https://access.redhat.com/errata/RHSA-2024:5143
- https://access.redhat.com/errata/RHSA-2024:5144
- https://access.redhat.com/errata/RHSA-2024:5147
- https://geometrydashbreeze.org
- https://access.redhat.com/errata/RHSA-2024:6883
- https://troubleshoot.dev/
- https://latestmerch.com/
- https://programable/
- https://programable.com/
- https://bugzilla.redhat.com/show_bug.cgi?id=2292211
Frequently Asked Questions
What is the severity of REDHAT-BUG-2292211?
The severity of REDHAT-BUG-2292211 is considered moderate due to the potential for resource exhaustion.
How do I fix REDHAT-BUG-2292211?
To fix REDHAT-BUG-2292211, you should update to the latest version of Undertow that addresses this vulnerability.
What specific issue does REDHAT-BUG-2292211 cause?
REDHAT-BUG-2292211 causes the Undertow server to hang after flushing chunked response body, leading to client timeout.
What are the potential impacts of REDHAT-BUG-2292211?
The potential impacts of REDHAT-BUG-2292211 include delayed response times and uncontrolled resource consumption on the server.
Which versions of Undertow are affected by REDHAT-BUG-2292211?
The specific versions of Undertow affected by REDHAT-BUG-2292211 are not detailed in the description, so all deployed versions should be reviewed.
- agent/severity
- agent/type
- agent/description
- agent/first-publish-date
- agent/event
- agent/references
- agent/source
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2024-5971
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/undertow
- canonical/undertow