Skip to content
Fencer Intel
high 7.5

CVE-2022-2053 json

Undertow vulnerable to Dos via Large AJP request

published 4y ago modified 4mo ago also GHSA-95rf-557x-44g5 , EUVD-2022-6522

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 65%
public exploits
0
none known

Summary

When a POST request comes through AJP and the request exceeds the max-post-size limit (maxEntitySize), Undertow's AjpServerRequestConduit implementation closes a connection without sending any response to the client/proxy. This behavior results in that a front-end proxy marking the backend worker (application server) as an error state and not forward requests to the worker for a while. In mod_cluster, this continues until the next STATUS request (10 seconds intervals) from the application server updates the server state. So, in the worst case, it can result in "All workers are in error state" and mod_cluster responds "503 Service Unavailable" for a while (up to 10 seconds). In mod_proxy_balancer, it does not forward requests to the worker until the "retry" timeout passes. However, luckily, mod_proxy_balancer has "forcerecovery" setting (On by default; this parameter can force the immediate recovery of all workers without considering the retry parameter of the workers if all workers of a balancer are in error state.). So, unlike mod_cluster, mod_proxy_balancer does not result in responding "503 Service Unavailable". An attacker could use this behavior to send a malicious request and trigger server errors, resulting in DoS (denial of service). This flaw was fixed in Undertow 2.2.19.Final, Undertow 2.3.0.Alpha2.

Patch / fix

  • maven io.undertow:undertow-core 2.2.19.Final, 2.3.0.Alpha2
  • redhat undertow 2.2.19
  • undertow Debian 14 2.2.18-1

debian advisories DEBIAN-CVE-2022-2053

  • eap7-undertow jboss enterprise application platform 7.4 2.2.19-1.SP2_redhat_00001.1.el9eap
  • eap7-snakeyaml jboss enterprise application platform 7.4 1.31.0-1.redhat_00001.1.el9eap
  • eap7-undertow jboss enterprise application platform 7.4 2.2.19-1.SP2_redhat_00001.1.el7eap
  • eap7-snakeyaml jboss enterprise application platform 7.4 1.31.0-1.redhat_00001.1.el7eap
  • eap7-undertow jboss enterprise application platform 7.4 2.2.19-1.SP2_redhat_00001.1.el8eap
  • eap7-snakeyaml jboss enterprise application platform 7.4 1.31.0-1.redhat_00001.1.el8eap
  • eap7-netty jboss enterprise application platform eus 7.3 4.1.63-5.Final_redhat_00003.1.el7eap
  • eap7-wildfly jboss enterprise application platform eus 7.3 7.3.14-3.GA_redhat_00002.1.el7eap

red hat advisories RHSA-2025:9583RHSA-2025:4226RHSA-2022:6823RHSA-2022:6821RHSA-2022:6822

Is CVE-2022-2053 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-2053 updated cvss 7.5

undertow: Large AJP request may cause DoS

  • Red Hat Data Grid 8 undertow undertow
    affected: no fix planned “Will not fix”
  • Red Hat Integration Camel K 1 undertow undertow
    affected: no fix available
  • Red Hat Integration Camel Quarkus 1 undertow undertow
    affected: no fix available “Fix deferred”
  • Red Hat JBoss Data Grid 7 undertow undertow Red Hat JBoss Fuse 6 undertow undertow Red Hat OpenStack Platform 13 (Queens) opendaylight
    affected: no fix planned “Out of support scope”
  • Red Hat Fuse 7.11.1
    fixed: vendor fix RHSA-2022:8652
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-undertow 2.2.19-1.SP2_redhat_00001.1.el7eap
    fixed: vendor fix RHSA-2022:6821
  • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-undertow 2.2.19-1.SP2_redhat_00001.1.el8eap
    fixed: vendor fix RHSA-2022:6822
  • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-undertow 2.2.19-1.SP2_redhat_00001.1.el9eap
    fixed: vendor fix RHSA-2022:6823
show 4 more
  • Red Hat JBoss Enterprise Application Platform undertow-core 2.2.19.SP2-redhat-00001
    fixed: vendor fix RHSA-2022:6825
  • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-jsoup 1.14.2-1.redhat_00002.1.ep7.el7, eap7-wildfly 7.1.10-2.GA_redhat_00002.1.ep7.el7, eap7-woodstox-core 5.0.3-2.redhat_00002.1.ep7.el7, eap7-xml-security 2.0.10-2.redhat_00002.1.ep7.el7, eap7-undertow 1.4.18-14.SP13_redhat_00001.1.ep7.el7, eap7-artemis-native 1.5.5.016-1.redhat_00001.1.ep7.el7, +19 more
    fixed: vendor fix RHSA-2025:4226
  • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-wildfly 7.3.14-3.GA_redhat_00002.1.el7eap, eap7-netty 4.1.63-5.Final_redhat_00003.1.el7eap, eap7-jackson-core 2.10.4-3.redhat_00006.1.el7eap, eap7-undertow 2.0.41-4.SP5_redhat_00001.1.el7eap, eap7-netty-all 4.1.63-5.Final_redhat_00003.1.el7eap, eap7-jackson-databind 2.10.4-5.redhat_00006.1.el7eap, +37 more
    fixed: vendor fix RHSA-2025:9583
  • Red Hat build of Quarkus undertow undertow Red Hat Decision Manager 7 undertow undertow Red Hat Integration Service Registry undertow undertow Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-snakeyaml 1.31.0-1.redhat_00001.1.el7eap, eap7-wildfly 7.4.7-3.GA_redhat_00003.1.el7eap, eap7-netty 4.1.77-3.Final_redhat_00001.1.el7eap, eap7-ironjacamar 1.5.3-3.SP2_redhat_00001.1.el7eap, eap7-resteasy 3.15.4-1.Final_redhat_00001.1.el7eap, eap7-hibernate 5.3.28-1.Final_redhat_00001.1.el7eap, +94 more Red Hat JBoss EAP 7.4 for RHEL 8 eap7-snakeyaml 1.31.0-1.redhat_00001.1.el8eap, eap7-wildfly 7.4.7-3.GA_redhat_00003.1.el8eap, eap7-netty 4.1.77-3.Final_redhat_00001.1.el8eap, eap7-ironjacamar 1.5.3-3.SP2_redhat_00001.1.el8eap, eap7-resteasy 3.15.4-1.Final_redhat_00001.1.el8eap, eap7-hibernate 5.3.28-1.Final_redhat_00001.1.el8eap, +92 more Red Hat JBoss EAP 7.4 for RHEL 9 eap7-snakeyaml 1.31.0-1.redhat_00001.1.el9eap, eap7-wildfly 7.4.7-3.GA_redhat_00003.1.el9eap, eap7-netty 4.1.77-3.Final_redhat_00001.1.el9eap, eap7-ironjacamar 1.5.3-3.SP2_redhat_00001.1.el9eap, eap7-resteasy 3.15.4-1.Final_redhat_00001.1.el9eap, eap7-hibernate 5.3.28-1.Final_redhat_00001.1.el9eap, +89 more
    +4 more products
    Red Hat JBoss Enterprise Application Platform pom.xml, c3 0.6.0, c3 0.7.1, d3 5.9.2, ms 2.0.0, ms 2.1.2, +1487 more Red Hat Process Automation 7 undertow undertow Red Hat Single Sign-On 7 undertow undertow Red Hat support for Spring Boot undertow undertow
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.09% chance of exploitation in the next 30 days, higher than 65% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
maven io.undertow:undertow-core
<2.2.19.Final
>=2.3.0.Alpha1, <2.3.0.Alpha2
2.2.19.Final
2.3.0.Alpha2

Affected products

  • n/a Undertow

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.