REDHAT-BUG-2483133: High severity Red Hat JBoss EAP vulnerability
original reporting: https://docs.google.com/document/d/1Rf4NtLudECimDNy8F9clUblm6Avx8yF/edit
DoS — ChunkReader TrailerParser unbounded HeaderMap accumulation (chunked trailer OOM) (JBoss EAP)
JBoss EAP's Undertow HTTP/1.1 chunked-transfer decoder places no size or count limits on the trailer section that follows the terminal 0\r\n chunk, and trailer bytes are not counted against the configured max-entity-size limit; a single unauthenticated TCP connection streaming an arbitrarily large trailer value drives the JVM to OutOfMemoryError, taking down all deployments on the listener — this is fully mitigated when a re-framing L7 reverse proxy (nginx, HAProxy in http-mode, ALB) sits in front, but applies to direct-edge and L4/TCP load-balanced deployments. findings/jboss-eap68.md
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Place an L7 reverse proxy (nginx, HAProxy in http-mode, or ALB) in front of JBoss EAP so requests are re-framed by the proxy; this fully mitigates the chunked trailer unbounded HeaderMap accumulation OOM when using direct-edge and L4/TCP load-balanced deployments.