High

Undertow: out-of-memory error after several closed connections with wildfly-http-client protocol

Type: advisorySource: Official CVE List1 source record

A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and closes a connection with the HTTP port of the server and then closes the connection immediately, the server will end with both memory and open file limits exhausted at some point, depending on the amount of memory available. At HTTP upgrade to remoting, the WriteTimeoutStreamSinkConduit leaks connections if RemotingConnection is closed by Remoting ServerConnectionOpenListener. Because the remoting connection originates in Undertow as part of the HTTP upgrade, there is an external layer to the remoting connection. This connection is unaware of the outermost layer when closing the connection during the connection opening procedure. Hence, the Undertow WriteTimeoutStreamSinkConduit is not notified of the closed connection in this scenario. Because WriteTimeoutStreamSinkConduit creates a timeout task, the whole dependency tree leaks via that task, which is added to XNIO WorkerThread. So, the workerThread points to the Undertow conduit, which contains the connections and causes the leak.

Announced 19 Feb 2024Source revision 1

Original source ↗

CVE-2024-1635

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2024-1635

Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2

Source reference: /containers/cna/affected/1/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Fuse 7.13.0

Source reference: /containers/cna/affected/2/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7

Source reference: /containers/cna/affected/3/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7

Source reference: /containers/cna/affected/4/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7

Source reference: /containers/cna/affected/5/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7

Source reference: /containers/cna/affected/6/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7

Source reference: /containers/cna/affected/7/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7

Source reference: /containers/cna/affected/8/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7

Source reference: /containers/cna/affected/9/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7

Source reference: /containers/cna/affected/10/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

Source reference: /containers/cna/affected/11/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

Source reference: /containers/cna/affected/12/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

Source reference: /containers/cna/affected/13/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

Source reference: /containers/cna/affected/14/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

Source reference: /containers/cna/affected/15/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

Source reference: /containers/cna/affected/16/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

Source reference: /containers/cna/affected/17/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

Source reference: /containers/cna/affected/18/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

Source reference: /containers/cna/affected/19/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

Source reference: /containers/cna/affected/20/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7

Source reference: /containers/cna/affected/21/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat JBoss Enterprise Application Platform 7.4.16

Source reference: /containers/cna/affected/22/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

Source reference: /containers/cna/affected/23/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

Source reference: /containers/cna/affected/24/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

Source reference: /containers/cna/affected/25/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Single Sign-On 7.6 for RHEL 7

Source reference: /containers/cna/affected/26/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Single Sign-On 7.6 for RHEL 8

Source reference: /containers/cna/affected/27/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Single Sign-On 7.6 for RHEL 9

Source reference: /containers/cna/affected/28/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

RHEL-8 based Middleware Containers

Source reference: /containers/cna/affected/29/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

RHSSO 7.6.8

Source reference: /containers/cna/affected/30/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

OpenShift Serverless

Source reference: /containers/cna/affected/31/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Apache Camel 4 for Quarkus 3

Source reference: /containers/cna/affected/32/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Apache Camel for Spring Boot 3

Source reference: /containers/cna/affected/33/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Apache Camel for Spring Boot 4

Source reference: /containers/cna/affected/34/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Apicurio Registry 2

Source reference: /containers/cna/affected/35/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Build of Keycloak

Source reference: /containers/cna/affected/36/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of OptaPlanner 8

Source reference: /containers/cna/affected/37/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Quarkus

Source reference: /containers/cna/affected/38/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat build of Quarkus

Source reference: /containers/cna/affected/39/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Data Grid 8

Source reference: /containers/cna/affected/40/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Integration Camel K 1

Source reference: /containers/cna/affected/41/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Integration Camel Quarkus 2

Source reference: /containers/cna/affected/42/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat JBoss Data Grid 7

Source reference: /containers/cna/affected/43/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat JBoss Enterprise Application Platform 8

Source reference: /containers/cna/affected/44/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat JBoss Fuse Service Works 6

Source reference: /containers/cna/affected/45/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Red Hat Process Automation 7

Source reference: /containers/cna/affected/46/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

streams for Apache Kafka

Source reference: /containers/cna/affected/47/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "versions": [
      {
        "status": "affected",
        "version": "1.31.0"
      }
    ],
    "packageName": "undertow",
    "collectionURL": "https://github.com/undertow-io/undertow",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:apache_camel_spring_boot:4.4::el6"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_fuse:7.13"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Fuse 7.13.0",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:1.5.5.016-1.redhat_00001.1.ep7.el7",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "eap7-activemq-artemis",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7",
    "versions": [
      {
        "status": "unaffected",
        "version": "1:1.5.5.016-1.redhat_00001.1.ep7.el7",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "eap7-artemis-native",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:3.5.11-1.Final_redhat_00001.1.ep7.el7",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "eap7-jboss-xnio-base",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:1.14.2-1.redhat_00002.1.ep7.el7",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "eap7-jsoup",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:1.4.18-14.SP13_redhat_00001.1.ep7.el7",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "eap7-undertow",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:7.1.10-2.GA_redhat_00002.1.ep7.el7",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "eap7-wildfly",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:5.0.3-2.redhat_00002.1.ep7.el7",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "eap7-woodstox-core",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:2.0.10-2.redhat_00002.1.ep7.el7",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "eap7-xml-security",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:2.10.4-3.redhat_00006.1.el7eap",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "eap7-jackson-annotations",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:2.10.4-3.redhat_00006.1.el7eap",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "eap7-jackson-core",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:2.10.4-5.redhat_00006.1.el7eap",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "eap7-jackson-databind",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:2.10.4-3.redhat_00006.1.el7eap",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "eap7-jackson-jaxrs-providers",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:2.10.4-5.redhat_00006.1.el7eap",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "eap7-jackson-modules-base",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:2.10.4-2.redhat_00006.1.el7eap",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "eap7-jackson-modules-java8",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:1.7.2-16.Final_redhat_00017.1.el7eap",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "eap7-jboss-server-migration",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:4.1.63-5.Final_redhat_00003.1.el7eap",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "eap7-netty",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:2.0.41-4.SP5_redhat_00001.1.el7eap",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "eap7-undertow",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:7.3.14-3.GA_redhat_00002.1.el7eap",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "eap7-wildfly",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:1.10.17-1.Final_redhat_00001.1.el7eap",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "eap7-wildfly-elytron",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform:7.4"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7.4.16",
    "versions": [
      {
        "status": "unaffected",
        "version": "2.2.30.SP1-redhat-00001",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "io.undertow/undertow-core",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:2.2.30-1.SP1_redhat_00001.1.el8eap",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "eap7-undertow",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:2.2.30-1.SP1_redhat_00001.1.el9eap",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "eap7-undertow",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:2.2.30-1.SP1_redhat_00001.1.el7eap",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "eap7-undertow",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:red_hat_single_sign_on:7.6::el7"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Single Sign-On 7.6 for RHEL 7",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:18.0.13-1.redhat_00001.1.el7sso",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "rh-sso7-keycloak",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:red_hat_single_sign_on:7.6::el8"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Single Sign-On 7.6 for RHEL 8",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:18.0.13-1.redhat_00001.1.el8sso",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "rh-sso7-keycloak",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:red_hat_single_sign_on:7.6::el9"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Single Sign-On 7.6 for RHEL 9",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:18.0.13-1.redhat_00001.1.el9sso",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "rh-sso7-keycloak",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:rhosemc:1.0::el8"
    ],
    "vendor": "Red Hat",
    "product": "RHEL-8 based Middleware Containers",
    "versions": [
      {
        "status": "unaffected",
        "version": "7.6-46",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "rh-sso-7/sso76-openshift-rhel8",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:red_hat_single_sign_on:7.6"
    ],
    "vendor": "Red Hat",
    "product": "RHSSO 7.6.8",
    "packageName": "undertow",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:serverless:1"
    ],
    "vendor": "Red Hat",
    "product": "OpenShift Serverless",
    "packageName": "undertow",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:camel_quarkus:3"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Apache Camel 4 for Quarkus 3",
    "packageName": "undertow",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:camel_spring_boot:3"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Apache Camel for Spring Boot 3",
    "packageName": "undertow",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:camel_spring_boot:4"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Apache Camel for Spring Boot 4",
    "packageName": "undertow",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:service_registry:2"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Apicurio Registry 2",
    "packageName": "undertow",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:build_keycloak:"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Build of Keycloak",
    "packageName": "undertow",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:optaplanner:::el6"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of OptaPlanner 8",
    "packageName": "undertow",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:quarkus:2"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Quarkus",
    "packageName": "quarkus-undertow",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:quarkus:3"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat build of Quarkus",
    "packageName": "quarkus-undertow",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_data_grid:8"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Data Grid 8",
    "packageName": "undertow",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:integration:1"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Integration Camel K 1",
    "packageName": "undertow",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:camel_quarkus:2"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Integration Camel Quarkus 2",
    "packageName": "undertow",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_data_grid:7"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Data Grid 7",
    "packageName": "undertow",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_application_platform:8"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Enterprise Application Platform 8",
    "packageName": "undertow-core",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_fuse_service_works:6"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Fuse Service Works 6",
    "packageName": "undertow",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Process Automation 7",
    "packageName": "undertow",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:amq_streams:1"
    ],
    "vendor": "Red Hat",
    "product": "streams for Apache Kafka",
    "packageName": "undertow",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected"
  }
]

Related CVEs: CVE-2024-1635
Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event: #12316 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 00:05:24 GMT
Publisher date: Mon, 19 Feb 2024 21:23:14 GMT

Read the original announcement