Skip to content
Fencer Intel
high 7.5

CVE-2024-5971 json

Undertow: response write hangs in case of java 17 tlsv1.3 newsessionticket

published 2y ago modified 4d ago also EUVD-2024-2452 , GHSA-xpp6-8r3j-ww43

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.9%
EPSS 2.9% chance of exploitation in 30 days, percentile 87%
public exploits
0
none known

Summary

A vulnerability was found in Undertow, where the chunked response hangs after the body was flushed. The response headers and body were sent but the client would continue waiting as Undertow does not send the expected 0\r\n termination of the chunked response. This results in uncontrolled resource consumption, leaving the server side to a denial of service attack. This happens only with Java 17 TLSv1.3 scenarios.

Patch / fix

  • maven io.undertow:undertow-core 2.2.34.Final, 2.3.15.Final
  • undertow-io undertow 2.2.34.Final, 2.3.15.Final
  • Red Hat Red Hat JBoss Enterprise Application Platform 2.2.33.SP1-redhat-00001
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 0:2.2.33-1.SP1_redhat_00001.1.el8eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 0:2.2.33-1.SP1_redhat_00001.1.el9eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 0:2.2.33-1.SP1_redhat_00001.1.el7eap
  • undertow Debian 14 2.3.18-1

debian advisories DEBIAN-CVE-2024-5971

  • eap7-netty jboss enterprise application platform 7.4 4.1.108-1.Final_redhat_00001.1.el9eap
  • eap7-jandex jboss enterprise application platform 7.4 2.4.5-1.Final_redhat_00001.1.el9eap
  • eap7-wildfly jboss enterprise application platform 7.4 7.4.18-1.GA_redhat_00001.1.el9eap
  • eap7-undertow jboss enterprise application platform 7.4 2.2.33-1.SP1_redhat_00001.1.el9eap
  • eap7-hal-console jboss enterprise application platform 7.4 3.3.23-1.Final_redhat_00001.1.el9eap
  • eap7-ironjacamar jboss enterprise application platform 7.4 1.5.17-1.Final_redhat_00001.1.el9eap
  • eap7-netty-codec jboss enterprise application platform 7.4 4.1.108-1.Final_redhat_00001.1.el9eap
  • eap7-bouncycastle jboss enterprise application platform 7.4 1.78.1-1.redhat_00002.1.el9eap

red hat advisories RHSA-2024:5145RHSA-2024:5144RHSA-2024:5143

Is CVE-2024-5971 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-5971 updated cvss 7.5

undertow: response write hangs in case of Java 17 TLSv1.3 NewSessionTicket

  • Red Hat build of Apache Camel - HawtIO 4 undertow undertow Red Hat build of Apache Camel for Spring Boot 3 undertow undertow Red Hat Fuse 7 undertow undertow
    affected: workaround, no fix available
  • Red Hat Integration Camel K 1 undertow undertow
    affected: workaround, no fix planned “Will not fix”
  • Red Hat JBoss Data Grid 7 undertow undertow Red Hat Process Automation 7 undertow undertow
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat build of Apache Camel 3.20.7 for Spring Boot
    fixed: vendor fix RHSA-2024:6883
  • Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2
    fixed: vendor fix RHSA-2024:4884
  • Red Hat build of Apache Camel 4.4.2 for Spring Boot
    fixed: vendor fix RHSA-2024:6508
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-undertow 2.2.33-1.SP1_redhat_00001.1.el7eap
    fixed: vendor fix RHSA-2024:5143
  • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-undertow 2.2.33-1.SP1_redhat_00001.1.el8eap
    fixed: vendor fix RHSA-2024:5144
show 4 more
  • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-undertow 2.2.33-1.SP1_redhat_00001.1.el9eap
    fixed: vendor fix RHSA-2024:5145
  • Red Hat JBoss Enterprise Application Platform undertow-core 2.2.33.SP1-redhat-00001
    fixed: vendor fix RHSA-2024:5147
  • Red Hat JBoss Enterprise Application Platform 8
    fixed: vendor fix RHSA-2024:4392
  • Red Hat Build of Keycloak undertow undertow Red Hat build of Quarkus quarkus-undertow Red Hat Data Grid 8 undertow undertow Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-wildfly 7.4.18-1.GA_redhat_00001.1.el7eap, eap7-jandex 2.4.5-1.Final_redhat_00001.1.el7eap, eap7-bouncycastle 1.78.1-1.redhat_00002.1.el7eap, eap7-netty 4.1.108-1.Final_redhat_00001.1.el7eap, eap7-bouncycastle-pg 1.78.1-1.redhat_00002.1.el7eap, eap7-netty-all 4.1.108-1.Final_redhat_00001.1.el7eap, +52 more Red Hat JBoss EAP 7.4 for RHEL 8 eap7-wildfly 7.4.18-1.GA_redhat_00001.1.el8eap, eap7-jandex 2.4.5-1.Final_redhat_00001.1.el8eap, eap7-bouncycastle 1.78.1-1.redhat_00002.1.el8eap, eap7-netty 4.1.108-1.Final_redhat_00001.1.el8eap, eap7-bouncycastle-pg 1.78.1-1.redhat_00002.1.el8eap, eap7-netty-all 4.1.108-1.Final_redhat_00001.1.el8eap, +53 more Red Hat JBoss EAP 7.4 for RHEL 9 eap7-wildfly 7.4.18-1.GA_redhat_00001.1.el9eap, eap7-jandex 2.4.5-1.Final_redhat_00001.1.el9eap, eap7-bouncycastle 1.78.1-1.redhat_00002.1.el9eap, eap7-netty 4.1.108-1.Final_redhat_00001.1.el9eap, eap7-bouncycastle-pg 1.78.1-1.redhat_00002.1.el9eap, eap7-bouncycastle-mail 1.78.1-1.redhat_00002.1.el9eap, +52 more
    +4 more products
    Red Hat JBoss Enterprise Application Platform pom.xml, jansi.dll, libjansi.so, xsdlib 2013.6.1, isorelax 20090621, artemis-service.exe, +723 more Red Hat JBoss Enterprise Application Platform 7 undertow-core Red Hat JBoss Enterprise Application Platform Expansion Pack undertow-core Red Hat Single Sign-On 7 undertow undertow
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2y ago

Exploit prediction

2.92% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
maven io.undertow:undertow-core
>=2.3.0.Alpha1, <2.3.15.Final
<2.2.34.Final
2.3.15.Final
2.2.34.Final

Affected products

  • undertow-io undertow
  • Red Hat Red Hat build of Apache Camel 3.20.7 for Spring Boot
  • Red Hat Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2
  • Red Hat Red Hat build of Apache Camel 4.4.2 for Spring Boot
  • Red Hat Red Hat JBoss Enterprise Application Platform
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 8
  • Red Hat Red Hat build of Apache Camel for Spring Boot 3
  • Red Hat Red Hat build of Apache Camel - HawtIO 4
  • Red Hat Red Hat Build of Keycloak
  • Red Hat Red Hat build of Quarkus
  • Red Hat Red Hat Data Grid 8
  • Red Hat Red Hat Fuse 7
  • Red Hat Red Hat Integration Camel K 1
  • Red Hat Red Hat JBoss Data Grid 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 7
  • Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Red Hat Process Automation 7
  • Red Hat Red Hat Single Sign-On 7

Classification

Weakness
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.