Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2024-6162

Undertow: url-encoded request path information can be broken on ajp-listener

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A vulnerability was found in Undertow, where URL-encoded request paths can be mishandled during concurrent requests on the AJP listener. This issue arises because the same buffer is used to decode the paths for multiple requests simultaneously, leading to incorrect path information being processed. As a result, the server may attempt to access the wrong path, causing errors such as "404 Not Found" or other application failures. This flaw can potentially lead to a denial of service, as legitimate resources become inaccessible due to the path mix-up.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

undertow

  • 0 to < 2.2.33.Finalaffected
  • 2.3.0.Alpha1 to < 2.3.14affected

Red Hat EAP 8.0.1

Default version status: unaffected

Red Hat Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2

Default version status: unaffected

Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack

Default version status: unaffected

Red Hat Red Hat build of Apache Camel for Spring Boot 3

Default version status: affected

Red Hat Red Hat build of Apache Camel - HawtIO 4

Default version status: unaffected

Red Hat Red Hat Build of Keycloak

Default version status: unaffected

Red Hat Red Hat Data Grid 8

Default version status: unaffected

Red Hat Red Hat Fuse 7

Default version status: affected

Red Hat Red Hat Integration Camel K 1

Default version status: affected

Red Hat Red Hat JBoss Data Grid 7

Default version status: affected

Red Hat Red Hat JBoss Enterprise Application Platform 7

Default version status: unaffected

Red Hat Red Hat JBoss Enterprise Application Platform 8

Default version status: unaffected

Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack

Default version status: affected

Red Hat Red Hat Process Automation 7

Default version status: affected

Red Hat Red Hat Single Sign-On 7

Default version status: affected

References