Riskcovery

CVE-2024-1635

Undertow: out-of-memory error after several closed connections with wildfly-http-client protocol

State
Published
Severity
7.5 High
Published
Feb 19, 2024
Updated
Oct 7, 2026
Reserved
Feb 19, 2024

Read the record on cve.org

Description

A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and closes a connection with the HTTP port of the server and then closes the connection immediately, the server will end with both memory and open file limits exhausted at some point, depending on the amount of memory available.

At HTTP upgrade to remoting, the WriteTimeoutStreamSinkConduit leaks connections if RemotingConnection is closed by Remoting ServerConnectionOpenListener. Because the remoting connection originates in Undertow as part of the HTTP upgrade, there is an external layer to the remoting connection. This connection is unaware of the outermost layer when closing the connection during the connection opening procedure. Hence, the Undertow WriteTimeoutStreamSinkConduit is not notified of the closed connection in this scenario. Because WriteTimeoutStreamSinkConduit creates a timeout task, the whole dependency tree leaks via that task, which is added to XNIO WorkerThread. So, the workerThread points to the Undertow conduit, which contains the connections and causes the leak.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hredhat

Weaknesses

  • CWE-400 Uncontrolled Resource Consumption

Affected Products

ProductVersions
undertow
  • 1.31.0Affected
Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2Red Hat
    Red Hat Fuse 7.13.0Red Hat
      Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Red Hat
      • 0:1.5.5.016-1.redhat_00001.1.ep7.el7 and laterNot affected
      Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Red Hat
      • 1:1.5.5.016-1.redhat_00001.1.ep7.el7 and laterNot affected
      Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Red Hat
      • 0:3.5.11-1.Final_redhat_00001.1.ep7.el7 and laterNot affected
      Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Red Hat
      • 0:1.14.2-1.redhat_00002.1.ep7.el7 and laterNot affected
      Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Red Hat
      • 0:1.4.18-14.SP13_redhat_00001.1.ep7.el7 and laterNot affected
      Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Red Hat
      • 0:7.1.10-2.GA_redhat_00002.1.ep7.el7 and laterNot affected
      Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Red Hat
      • 0:5.0.3-2.redhat_00002.1.ep7.el7 and laterNot affected
      Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7Red Hat
      • 0:2.0.10-2.redhat_00002.1.ep7.el7 and laterNot affected
      Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Red Hat
      • 0:2.10.4-3.redhat_00006.1.el7eap and laterNot affected
      Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Red Hat
      • 0:2.10.4-3.redhat_00006.1.el7eap and laterNot affected
      Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Red Hat
      • 0:2.10.4-5.redhat_00006.1.el7eap and laterNot affected
      Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Red Hat
      • 0:2.10.4-3.redhat_00006.1.el7eap and laterNot affected
      Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Red Hat
      • 0:2.10.4-5.redhat_00006.1.el7eap and laterNot affected
      Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Red Hat
      • 0:2.10.4-2.redhat_00006.1.el7eap and laterNot affected
      Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Red Hat
      • 0:1.7.2-16.Final_redhat_00017.1.el7eap and laterNot affected
      Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Red Hat
      • 0:4.1.63-5.Final_redhat_00003.1.el7eap and laterNot affected
      Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Red Hat
      • 0:2.0.41-4.SP5_redhat_00001.1.el7eap and laterNot affected
      Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Red Hat
      • 0:7.3.14-3.GA_redhat_00002.1.el7eap and laterNot affected
      Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7Red Hat
      • 0:1.10.17-1.Final_redhat_00001.1.el7eap and laterNot affected
      Red Hat JBoss Enterprise Application Platform 7.4.16Red Hat
      • 2.2.30.SP1-redhat-00001 and laterNot affected
      Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8Red Hat
      • 0:2.2.30-1.SP1_redhat_00001.1.el8eap and laterNot affected
      Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9Red Hat
      • 0:2.2.30-1.SP1_redhat_00001.1.el9eap and laterNot affected
      Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7Red Hat
      • 0:2.2.30-1.SP1_redhat_00001.1.el7eap and laterNot affected
      Red Hat Single Sign-On 7.6 for RHEL 7Red Hat
      • 0:18.0.13-1.redhat_00001.1.el7sso and laterNot affected
      Red Hat Single Sign-On 7.6 for RHEL 8Red Hat
      • 0:18.0.13-1.redhat_00001.1.el8sso and laterNot affected
      Red Hat Single Sign-On 7.6 for RHEL 9Red Hat
      • 0:18.0.13-1.redhat_00001.1.el9sso and laterNot affected
      RHEL-8 based Middleware ContainersRed Hat
      • 7.6-46 and laterNot affected
      RHSSO 7.6.8Red Hat
        OpenShift ServerlessRed Hat
          Red Hat build of Apache Camel 4 for Quarkus 3Red Hat
            Red Hat build of Apache Camel for Spring Boot 3Red Hat
              Red Hat build of Apache Camel for Spring Boot 4Red Hat
                Red Hat build of Apicurio Registry 2Red Hat
                  Red Hat Build of KeycloakRed Hat
                    Red Hat build of OptaPlanner 8Red Hat
                      Red Hat build of QuarkusRed Hat
                        Red Hat build of QuarkusRed Hat
                          Red Hat Data Grid 8Red Hat
                            Red Hat Integration Camel K 1Red Hat
                              Red Hat Integration Camel Quarkus 2Red Hat
                                Red Hat JBoss Data Grid 7Red Hat
                                  Red Hat JBoss Enterprise Application Platform 8Red Hat
                                    Red Hat JBoss Fuse Service Works 6Red Hat
                                      Red Hat Process Automation 7Red Hat
                                        streams for Apache KafkaRed Hat

                                          References

                                          Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.